CVE-2021-41765

PoC —

CVSS 3.1

9.8 critical

EPSS

68%p99

Published

Nov 15, 2021 (Nov 15, 2021)

Modified

Jun 17, 2026

Description

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.

Vendors: montala
Products: resourcespace
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (67.8%)

In the news0 stories

No ingested article mentions this CVE yet.