472 matches found
CVE-2025-25747
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint...
CVE-2025-25748
A CSRF vulnerability in the gestioneutenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions e.g., modifying user passwords on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disput...
CVE-2025-25749
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies...
CVE-2025-25747: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint...
Exploit for CVE-2525-25748
CVE-2025-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-i...
PT-2025-10459 · Unknown +1 · Hoteldruid +1
Name of the Vulnerable Software and Affected Versions: HotelDruid versions 3.0.7 and earlier Description: The issue allows users to set weak passwords due to the lack of enforcement of password strength policies. Recommendations: For HotelDruid versions 3.0.7 and earlier, consider implementing a...
PT-2025-10458
Name of the Vulnerable Software and Affected Versions: HotelDruid version 3.0.7 Description: A CSRF issue in the "gestione utenti.php" endpoint allows attackers to perform unauthorized actions, such as modifying user passwords, on behalf of authenticated users. This is due to the lack of origin o...
PT-2025-10457
Name of the Vulnerable Software and Affected Versions: DigitalDruid HotelDruid version 3.0.7 Description: The issue allows an attacker to execute arbitrary code and obtain sensitive information. This is achieved via the ripristina backup parameter in the "crea backup.php" endpoint. Recommendation...
Linux Distros Unpatched Vulnerability : CVE-2023-43374
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php. CVE-2023-43374 Note tha...
Linux Distros Unpatched Vulnerability : CVE-2023-34537
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browse...
Linux Distros Unpatched Vulnerability : CVE-2023-43377
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML v...
Linux Distros Unpatched Vulnerability : CVE-2023-43371
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php. CVE-2023-43371 Note that...
Linux Distros Unpatched Vulnerability : CVE-2023-43373
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php. CVE-2023-43373 Note...
Linux Distros Unpatched Vulnerability : CVE-2023-43376
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-site scripting XSS vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted...
Linux Distros Unpatched Vulnerability : CVE-2021-38559
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. CVE-2021-38559 Note that Nessus relies on the presen...
Linux Distros Unpatched Vulnerability : CVE-2022-26564
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. CVE-2022-26564...
Linux Distros Unpatched Vulnerability : CVE-2021-42948
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to...
CVE-2024-23091
Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values...
