CVE-2013-6415

score

<0.1

cvss

4.3

epss

3.2%

published

2013-12-07

kev added

—

first seen

2026-10-21

Ruby on Rails before 3.2.16 and 4.x before 4.0.2 contain a reflected cross-site scripting caused by unsanitized input in the number_to_currency helper, letting remote attackers inject arbitrary web script or HTML via the unit parameter, exploit requires attacker to craft a malicious request.