CVE-2019-25693 ResourceSpace 8.6 SQL Injection via collection_edit.php

ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keywords parameter in collectionedit.php. Attackers can submit POST requests with crafted SQL payloads in the keywords field to...

CVE-2019-25662

CVE-2019-25662 affects ResourceSpace 8.6 with an SQL injection in the watched_searches.php endpoint via the ref parameter. Unauthenticated attackers can send crafted GET requests to extract sensitive data (e.g., usernames and credentials). Public details document the vulnerability and its impact ...