| Package | Affected versions | Patched versions |
|---|---|---|
| geocoder | < 1.6.1 | 1.6.1 |
| geocoder | < 1.6.1 | 1.6.1 |
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free