What’s Vulnerable › Vulnerabilities

CVE-2015-10053: prodigasistemas curupira passwords_controller.rb sql injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-16 · updated 2026-06-17
• Weakness: CWE-89

Description

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The patch is identified as 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

Affected products

• prodigasistemas curupira: before 0.1.4 — fixed in 0.1.4

How to fix

Upgrade to a fixed version: prodigasistemas curupira 0.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271
• https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4
• https://vuldb.com/?ctiid.218394
• https://vuldb.com/?id.218394
• https://github.com/prodigasistemas/curupira/commit/93a9a77896bb66c949acb8e64bceafc74bc8c271
• https://github.com/prodigasistemas/curupira/releases/tag/v0.1.4
• https://vuldb.com/?ctiid.218394
• https://vuldb.com/?id.218394

Get alerted when CVE-2015-10053 or the next vulnerability affects your stack