CVE-2016-6317

score

<0.1

cvss

7.5

epss

3.9%

published

2016-09-07

kev added

—

first seen

2026-10-21

Ruby on Rails 4.2.x before 4.2.7.1 contains an action record vulnerability caused by inconsistent parameter handling between Active Record and JSON, letting remote attackers bypass database query restrictions and manipulate NULL checks via crafted requests, exploit requires sending specific '[nil]' values.