CVE-2011-1671

Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/. NOTE: some of these details are obtained from third party information.

• CWE-79

• http://osvdb.org/71352Exploit
• http://secunia.com/advisories/43909Vendor Advisory
• http://securityreason.com/securityalert/8196
• http://www.getontracks.org/downloads/comments/tracks-173Patch
• http://www.mavitunasecurity.com/XSS-vulnerability-in-Tracks/Exploit
• http://www.securityfocus.com/archive/1/517223/100/0/threaded
• http://www.securityfocus.com/bid/47078Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66561
• http://osvdb.org/71352Exploit
• http://secunia.com/advisories/43909Vendor Advisory
• http://securityreason.com/securityalert/8196
• http://www.getontracks.org/downloads/comments/tracks-173Patch
• http://www.mavitunasecurity.com/XSS-vulnerability-in-Tracks/Exploit
• http://www.securityfocus.com/archive/1/517223/100/0/threaded
• http://www.securityfocus.com/bid/47078Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66561

Published

Apr 10, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-1665PHPBoost 3.0 stores sensitive information under the web root…
• CVE-2011-1666Metaways Tine 2.0 allows remote attackers to obtain sensitiv…
• CVE-2011-1667SQL injection vulnerability in index.php in Anzeigenmarkt 20…
• CVE-2011-1668Cross-site scripting (XSS) vulnerability in search.php in AR…
• CVE-2011-1669Directory traversal vulnerability in wp-download.php in the …
• CVE-2011-1670Cross-site scripting (XSS) vulnerability in actions/add.php …
• CVE-2011-1672The Dell KACE K2000 Systems Deployment Appliance 3.3.36822 a…
• CVE-2011-1673BackupConfig.php on the NetGear ProSafe WNAP210 allows remot…
• CVE-2011-1674The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remo…
• CVE-2011-1675mount in util-linux 2.19 and earlier attempts to append to t…
• CVE-2011-1676mount in util-linux 2.19 and earlier does not remove the /et…
• CVE-2011-1677mount in util-linux 2.19 and earlier does not remove the /et…