ash_admin vulnerabilities (Hex)
7 vulnerabilities.
-
ash_adminHex Path traversal in AshAdmin file uploads via unsanitized client filename 8.3 High -
ash_adminHex AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle 2.3 Low -
ash_adminHex AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass 2.1 Low -
ash_adminHex Query-parameter injection in AshAdmin row-action links via unencoded string primary keys 2.0 Low -
ash_adminHex Stored XSS in AshAdmin relationship typeahead via unescaped label_field content 8.4 High -
ash_adminHex AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) 8.3 High -
ash_adminHex AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain 8.3 High