HotelDruid 2.3.0 - Cross-Site Scripting

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. id: CVE-2019-8937 info: name: HotelDruid 2.3.0 - Cross-Site Scripting author: LogicalHunte...

Hotel Druid 3.0.2 - Cross-Site Scripting

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. id: CVE-2021-37833 info: name: Hotel Druid 3.0.2 - Cross-Site Scripting author: pikpikcu,s4e-io severity: medium description: Hotel Druid 3.0.2 contains a...

Hoteldruid 3.0.5 - Cross-Site Scripting

A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data. id: CVE-2023-34537 info: name: Hoteldruid 3.0.5 - Cross-Site Scripting author: Harsh severity: medium...

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php. id: CVE-2023-43373 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php. id: CVE-2023-43374 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

CVE-2023-33817---SQL-Injection-found-in-HotelDruid-3.0.5

CVE-2023-33817 - SQL Injection found in HotelDruid V3.0.5 HotelDruid v3.0.5 are vulnerable to SQL injection. An attacker could issue arbitrary sql command to retrieve data in databases or even execute remote code execution on target database system This is my second repo. Don't beat me if i didn'...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Reflected XSS Vulnerability in HotelDruid 3.0.7 Description Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint Severi...

CVE-2025-44203

CVE-2025-44203: HotelDruid 3.0.0 / 3.0.7 Sensitive Information Disclosure and DoS Summary HotelDruid 3.0.0 and 3.0.7 contain a race condition on the creadb.php setup endpoint, reachable before the setup is finished. It has two impacts, and both come from the same lost race: a sensitive informatio...

CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7 Description A Cross Site Request Forgery CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of...

CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5

CVE-2023-34537--- Reflected XSS found in HotelDruid V3.0.5 HotelDruid v3.0.5 are vulnerable to multipe XSS vulnerabilities. These vulnerabilities could allows remote authenticated attackers to inject arbitrary web script or HTML. This is my third repo. Don't beat me if i didn't explain well...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7 Description A vulnerability in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. Impact Weak Passwords Accepted: Attackers can guess simple passwords or use...

CVE-2025-55816

CVE-2025-55816 CVE-2025-55816 HotelDruid 3.0.7 Author: partywave Collab: Raptx team External references HotelDruid 3.0.8 changelog CVE blogpost Raptx site Vulnerability The vulnerability is a simple Stored Cross Site Scripting XSS in /modificaapp.php endpoint. The attacker can insert a javascript...

HotelDruid-CVE-2021-42949

CVE-2021-42949 The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks. The session id is dynamically created at each login using the following generalized syntax...

HotelDruid-CVE-2021-42948

CVE-2021-42948 HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. The session token used to access authenticated pages of the application is passed using GET...

CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

UBUNTU-CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

EUVD-2023-60662

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

CVE-2023-34854

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...

Debian: CVE-2023-34854: hoteldruid -- security update

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function...