CVE-2014-0081

score

<0.1

cvss

4.3

epss

4.0%

published

2014-02-20

kev added

—

first seen

2026-10-21

Ruby on Rails < 3.2.17, 4.0.x < 4.0.3, and 4.1.x < 4.1.0.beta2 contain multiple cross-site scripting (XSS) vulnerabilities caused by unsanitized input in number_helper.rb, letting remote attackers inject arbitrary web script or HTML via format, negative_format, or units parameters in number_to_currency, number_to_percentage, or number_to_human helpers, exploit requires attacker to send crafted parameters.