CVE-2014-0080

score

<0.1

cvss

6.8

epss

1.3%

published

2014-02-20

kev added

—

first seen

2026-10-21

Ruby on Rails 4.0.x before 4.0.3 and 4.1.0.beta1 contain a sql_injection caused by improper handling of backslash characters in array column operations in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb, letting remote attackers execute arbitrary SQL commands, exploit requires PostgreSQL usage.