CVE-2021-41765

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.

• CWE-89

• http://svn.resourcespace.com/svn/rs/releases/9.6/pages/edit_fields/9_ajax/add_keyword.phpBroken Link, Vendor Advisory
• https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/Exploit, Third Party Advisory
• http://svn.resourcespace.com/svn/rs/releases/9.6/pages/edit_fields/9_ajax/add_keyword.phpBroken Link, Vendor Advisory
• https://www.horizon3.ai/multiple-vulnerabilities-in-resourcespace/Exploit, Third Party Advisory

Published

Nov 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41753A denial-of-service attack in WPA2, and WPA3-SAE authenticat…7.5
• CVE-2021-41754dynamicMarkt <= 3.10 is affected by SQL injection in the par…9.8
• CVE-2021-41755dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-41756dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-4176livehelperchat is vulnerable to Improper Neutralization of I…6.1
• CVE-2021-41764A cross-site request forgery (CSRF) vulnerability exists in …8.8
• CVE-2021-41766Apache Karaf allows monitoring of applications and the Java …8.1
• CVE-2021-41767Apache Guacamole 1.3.0 and older may incorrectly include a p…6.5
• CVE-2021-41769A vulnerability has been identified in SIPROTEC 5 6MD85 devi…7.5
• CVE-2021-4177livehelperchat is vulnerable to Generation of Error Message …5.3
• CVE-2021-41770Ping Identity PingFederate before 10.3.1 mishandles pre-pars…7.5
• CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go b…7.5