ash-project ash_admin vulnerabilities

Path traversal in AshAdmin file uploads via unsanitized client filename

ash-project · ash_admin

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

ash-project · ash_admin

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

ash-project · ash_admin

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

ash-project · ash_admin

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

ash-project · ash_admin

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

ash-project · ash_admin

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

ash-project · ash_admin