Description
ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials.
Published: 2026-04-05
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 05 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
Description ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials.
Title ResourceSpace 8.6 SQL Injection via watched_searches.php
First Time appeared Montala
Montala resourcespace
Weaknesses CWE-89
CPEs cpe:2.3:a:montala:resourcespace:8.6:*:*:*:*:*:*:*
Vendors & Products Montala
Montala resourcespace
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Montala Resourcespace
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-05T20:45:16.812Z

Reserved: 2026-04-05T12:59:40.774Z

Link: CVE-2019-25662

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-05T21:16:43.223

Modified: 2026-04-05T21:16:43.223

Link: CVE-2019-25662

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses