Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Montala

First CVE: Nov 19, 2011Active for: 15 yearsTotal CVEs: 9

Montala maintains a resource-management platform, ResourceSpace, that sits in institutional and media-workflow environments and has an elevated tendency toward critical-severity outcomes across its disclosures. The vendor's exposure concentrates around application-layer input handling and request validation, with recurring weakness classes including SQL injection, path traversal, cross-site scripting, and cross-site request forgery, alongside improper input validation—defects typical of web applications with broad user input surfaces. Vulnerabilities affecting this vendor frequently acquire public exploit code, reflecting the accessibility and appeal of web-facing asset-management platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
9
Total CVEs
More Total CVEs than 91% of tracked vendors
1.8
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 80% of tracked vendors
7.4
Avg CVSS Score
Higher Avg CVSS Score than 56% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Montala over time

Volume of CVEsAvg CVSS Base Score
First CVE
Nov 19, 2011
14 years ago
Most Recent CVE
Apr 12, 2026
103 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (9 CVEs).

9 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2021-41951MEDIUM
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an at
Nov 15, 20216.173NOYES
CVE-2021-41950CRITICAL
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider
Nov 15, 20219.168NONO
CVE-2021-41765CRITICAL
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands
Nov 15, 20219.864NONO
CVE-2015-3648HIGH
Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before 7.2.6727 allows remote attackers to include and execute arbitrary local files via a ..
Jun 9, 20157.531NOYES
CVE-2019-25662HIGH
ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' param
Apr 5, 20268.227NONO
CVE-2022-31260MEDIUM
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.
Jul 17, 20226.526NOYES
CVE-2019-25693HIGH
ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the keywords para
Apr 12, 20267.123NONO
CVE-2015-6915HIGH
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedbac
Sep 11, 20157.520NONO
CVE-2011-4311MEDIUM
ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.
Nov 19, 20115.018NONO
View all 9 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products9 CVEs
33%
44%
22%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network6 (66.7%)
Unknown3 (33.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (66.7%)
High0 (0.0%)
Unknown3 (33.3%)
User Interaction
None5 (55.6%)
Unknown3 (33.3%)
Required1 (11.1%)
Privileges Required
Low1 (11.1%)
High0 (0.0%)
None5 (55.6%)
Unknown3 (33.3%)

Exploit Exposure

Signals from CVEs in this vendor scope (9 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
3 CVEs
33.3% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Montala.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Montala — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Montala's Products

View all 3 CNAs →

Top CWEs