Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters. This issue affects Spring AI: from 1.0.0 before...

CVE-2026-2348

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Quick Edit allows Cross-Site Scripting XSS.This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1...

CVE-2023-1141

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary commands, which could result in remote code execution...

CVE-2023-1137

Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation...

PT-2025-4923 · Unknown · Blokhaus Minterpress

Name of the Vulnerable Software and Affected Versions: Blokhaus Minterpress versions n/a through 1.0.5 Description: The issue is related to a lack of authorization in Blokhaus Minterpress, allowing access to functions that are not properly constrained by access control lists ACLs. Recommendations...

social-media-skeleton 跨站请求伪造漏洞

social-media-skeleton is an unfinished social media project implemented in php, css, javascript and html by the individual developer fobybus. A cross-site request forgery vulnerability exists in social-media-skeleton versions prior to 1.0.5, which stems from the presence of a cross-site request...

FreeXL heap buffer out-of-bounds read vulnerability (CNVD-2018-05153)

FreeXL is an open source library for extracting valid data from Excel .xls spreadsheets developed by software developer Alessandro Furieri. A heap buffer out-of-bounds read vulnerability exists in the 'parseSST' function in versions of FreeXL prior to 1.0.5. An attacker can exploit this...

DEBIAN-CVE-2015-1433

program/lib/Roundcube/rcubewashtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting XSS attacks via the style attribute in an email...