ResourceSpace 8.6 includes an unauthenticated SQL injection flaw in the watched_searches.php endpoint. By sending a crafted GET request that supplies malicious SQL in the ref parameter, an attacker can execute arbitrary database statements. The consequence is a breach of confidentiality, allowing extraction of usernames, passwords, and other sensitive data directly from the database. This issue maps to the common weakness enumeration for SQL injection (CWE-89).

Montala’s ResourceSpace version 8.6, the edition listed in the vendor’s CNAs, is affected. Users running this exact version are vulnerable; no other versions are identified in the provided data.

The CVSS score of 8.8 underscores a high severity, and the EPSS score of less than 1% indicates that exploit attempts are expected to be rare. The vulnerability is not yet catalogued by CISA’s KEV list. The attack can be launched simply by hacking a web request to the watched_searches.php endpoint without needing any prior authentication, making exploitation straightforward but still highly impactful. There is no mention of additional prerequisites or required software weaknesses beyond this single endpoint.