CVE-2019-25693CWE-352

ResourceSpace 8.6 SQL Injection via collection_edit.php

High · published April 12, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
4.7
In the wild
Unconfirmed
What it is

ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keywords parameter in collection_edit.php. Attackers can submit POST requests with crafted SQL payloads in the keywords field to extract sensitive database information including schema names, user credentials, and other confidential data.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00159 · 4.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-04-12T12:28Z
EPSS history
Timeline
  • 12 APR 12:28Z
    ResourceSpace 8.6 SQL Injection via collection_edit.php
    cvelistv5