CVE-2015-3648

ResourceSpace (Montala Limited) is affected by a Local File Inclusion in pages/setup.php due to insufficient sanitization of the defaultlanguage parameter, allowing remote attackers to include and execute local files. The issue affects ResourceSpace up to version 7.2.6727 (vendor advisory referen...

CVE-2022-31260

ResourceSpace CVE-2022-31260 affects Montala ResourceSpace up to version 9.8 prior to r19636. The flaw is in csv_export_results_metadata.php, where an attacker can export collection metadata by providing a non-NULL k value. Impact: unauthorized access to metadata. Mitigation: upgrade to the fixed...

CVE-2021-41951

ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. A victim clicking a crafted URL can have arbitrary JavaScript executed in their browser, enabling potential session hijacking...

CVE-2021-41765

Affected software : ResourceSpace 9.5–9.6 (rev 18274). Vulnerability : SQL injection in pages/edit_fields/9_ajax/add_keyword.php allows remote unauthenticated attackers to run arbitrary SQL commands via the k parameter. This can reveal the full contents of the ResourceSpace database and, if an ad...

CVE-2021-41950

ResourceSpace 9.6 is affected by a directory traversal vulnerability (CVE-2021-41950) that allows remote unauthenticated attackers to delete arbitrary files on the server via the provider and variant parameters in pages/ajax/tiles.php, potentially taking the application offline. Affected versions...

CVE-2011-4311

CVE-2011-4311 affects ResourceSpace before 4.2.2833, where improper validation of access keys allows remote attackers to bypass intended resource restrictions via unspecified vectors. The vulnerability enables unauthorized access without specific vectors described in the provided documents. No ex...

CVE-2015-6915

The CVE-2015-6915 entry concerns Montala Limited ResourceSpace (open source DAM) up to version 7.3.7009 and earlier. The vulnerability is a SQL injection in the plugins/feedback/pages/feedback.php handler, exploitable via the "user" cookie. This is a server-side issue that allows remote attackers...

CVE-2019-25662

CVE-2019-25662 affects ResourceSpace 8.6 with an SQL injection in the watched_searches.php endpoint via the ref parameter. Unauthenticated attackers can send crafted GET requests to extract sensitive data (e.g., usernames and credentials). Public details document the vulnerability and its impact ...

CVE-2019-25693

CVE-2019-25693 – ResourceSpace 8.6 SQL injection : An authenticated attacker can inject malicious SQL via the keywords parameter in collection_edit.php (also noted as collection edit.php in some sources), enabling execution of arbitrary queries and extraction of sensitive data such as schema info...