Skip to content
Fencer Vulns
critical 9.8

CVE-2021-41765 in the critical feed json

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated at…

published 2021-11-15 4 y ago modified 2026-06-17 4 mo ago also BIT-resourcespace-2021-41765 , EUVD-2021-28774

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
67.8%
EPSS 67.8% chance of exploitation in 30 days, percentile 99.3%
public exploits
0
none known

Summary

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.

Exploit prediction

67.84% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • horizon3.ai https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami resourcespace
>=9.5.0, <=9.5.0
>=9.6.0, <=9.6.0
 no fix listed

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.