AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2016-6317

HIGH · CVSS 7.5 EPSS 3.90%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2016-09-07 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 7.5. It may be remotely exploitable.

CVE
CVE-2016-6317
Severity
HIGH
CVSS
7.5
EPSS
3.90%

Original NVD Description

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.