VulnerableCode Package Details - pkg:gem/activerecord@5.1.2

Vulnerabilities affecting this package (9)

Vulnerability	Summary	Fixed by
VCID-12f4-gcj5-h3cu Aliases: CVE-2012-2695 GHSA-76wq-xw4h-f8wj	activerecord vulnerable to SQL Injection The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.	There are no reported fixed by versions.
VCID-1r5t-n9ys-zbbu Aliases: CVE-2011-0448 GHSA-jmm9-2p29-vh2w	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.	There are no reported fixed by versions.
VCID-2bpy-kbwe-zbg8 Aliases: CVE-2022-32224 GHSA-3hhc-qp5v-9p2j		5.2.8.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.0.0.beta1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.0.5.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.1.0.rc1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.1.6.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 7.0.0.alpha1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 7.0.3.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-2dgz-cqjx-bkaw Aliases: CVE-2011-2930 GHSA-h6w6-xmqv-7q78	activerecord vulnerable to SQL Injection Multiple SQL injection vulnerabilities in the `quote_table_name` method in the ActiveRecord adapters in `activerecord/lib/active_record/connection_adapters/` in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.	There are no reported fixed by versions.
VCID-c3hd-njh3-b3bg Aliases: CVE-2008-4094 GHSA-xf96-32q2-9rw2	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.	There are no reported fixed by versions.
VCID-v12d-fr9k-7ufu Aliases: CVE-2025-55193 GHSA-76r7-hhxj-r776		7.1.5.2 Affected by 0 other vulnerabilities. 7.2.0.beta1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 7.2.2.2 Affected by 0 other vulnerabilities. 8.0.0.beta1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.2.1 Affected by 0 other vulnerabilities.
VCID-vbkg-umrg-gkfm Aliases: CVE-2022-44566 GHSA-579w-22j4-4749 GMS-2023-59	Duplicate This advisory duplicates another.	6.1.7.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 7.0.4.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-w3hp-78sw-hfa4 Aliases: CVE-2021-22880 GHSA-8hc4-xxm3-5ppp		5.2.4.5 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.0.3.5 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.1.2.1 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-zy5d-6a4f-wua5 Aliases: CVE-2010-3933 GHSA-gjxw-5w2q-7grf	Improper Input Validation Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.	There are no reported fixed by versions.

Next non-vulnerable version	7.1.5.2
Latest non-vulnerable version	8.0.2.1
Risk

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-01T08:48:12.418393+00:00	GitLab Importer	Affected by	VCID-v12d-fr9k-7ufu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activerecord/CVE-2025-55193.yml	38.6.0
2026-06-01T07:15:44.126684+00:00	GitLab Importer	Affected by	VCID-vbkg-umrg-gkfm	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activerecord/CVE-2022-44566.yml	38.6.0
2026-06-01T06:58:31.931704+00:00	GitLab Importer	Affected by	VCID-2bpy-kbwe-zbg8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activerecord/CVE-2022-32224.yml	38.6.0
2026-06-01T06:02:35.016262+00:00	GitLab Importer	Affected by	VCID-w3hp-78sw-hfa4	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activerecord/CVE-2021-22880.yml	38.6.0
2026-05-31T10:20:21.076958+00:00	Ruby Importer	Affected by	VCID-v12d-fr9k-7ufu	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2025-55193.yml	38.6.0
2026-05-31T10:16:33.120323+00:00	Ruby Importer	Affected by	VCID-1r5t-n9ys-zbbu	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2011-0448.yml	38.6.0
2026-05-31T10:16:28.112862+00:00	Ruby Importer	Affected by	VCID-zy5d-6a4f-wua5	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.yml	38.6.0
2026-05-31T10:16:19.749820+00:00	Ruby Importer	Affected by	VCID-12f4-gcj5-h3cu	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2695.yml	38.6.0
2026-05-31T10:16:15.696356+00:00	Ruby Importer	Affected by	VCID-2dgz-cqjx-bkaw	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2011-2930.yml	38.6.0
2026-05-31T10:16:04.904188+00:00	Ruby Importer	Affected by	VCID-c3hd-njh3-b3bg	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2008-4094.yml	38.6.0