Unrated severityNVD Advisory· Published Apr 10, 2011· Updated Jun 16, 2026
CVE-2011-1671
CVE-2011-1671
Description
Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/. NOTE: some of these details are obtained from third party information.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:getontracks:tracks:1.7.2:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:getontracks:tracks:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:getontracks:tracks:2.0:devel:*:*:*:*:*:*
- cpe:2.3:a:getontracks:tracks:2.0:rc2:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
8- www.getontracks.org/downloads/comments/tracks-173nvdPatch
- osvdb.org/71352nvdExploit
- www.mavitunasecurity.com/XSS-vulnerability-in-Tracks/nvdExploit
- www.securityfocus.com/bid/47078nvdExploit
- secunia.com/advisories/43909nvdVendor Advisory
- securityreason.com/securityalert/8196nvd
- www.securityfocus.com/archive/1/517223/100/0/threadednvd
- exchange.xforce.ibmcloud.com/vulnerabilities/66561nvd
News mentions
0No linked articles in our index yet.