CVE-2023-43377

A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatarioemail1 parameter...

CVE-2023-43374

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php...

CVE-2023-43373

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php...

CVE-2023-43373

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php...

CVE-2023-43374

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php...

CVE-2023-43375

Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, linguacli, mesenascita, and mesescaddoc parameters...

CVE-2023-43376

A cross-site scripting XSS vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter...

CVE-2023-43377

A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatarioemail1 parameter...

PT-2023-28811 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A SQL injection vulnerability was discovered in Hoteldruid via the id utente log parameter at the "/hoteldruid/personalizza.php" API endpoint. This issue allows for potential SQL injection attacks...

PT-2023-28814 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A cross-site scripting XSS vulnerability in /hoteldruid/visualizza contratto.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatario email1...

PT-2023-28812 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities are located at the /hoteldruid/clienti.php endpoint via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua...

PT-2023-28813 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A cross-site scripting XSS vulnerability in /hoteldruid/clienti.php allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter...

PT-2023-28810 · Unknown +1 · Hoteldruid +1

Name of the Vulnerable Software and Affected Versions: Hoteldruid version 3.0.5 Description: A SQL injection vulnerability was discovered in Hoteldruid via the n utente agg parameter at the "/hoteldruid/interconnessioni.php" API endpoint. This issue allows for SQL injection attacks, potentially...

CVE-2023-43377

A cross-site scripting XSS vulnerability in /hoteldruid/visualizzacontratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatarioemail1 parameter...

CVE-2023-43371

CVE-2023-43371 affects Hoteldruid v3.0.5 with a SQL injection in the numcaselle parameter of the /hoteldruid/creaprezzi.php endpoint. The vulnerability is rated CRITICAL (CVSS v3.1: 9.8, Network, Low Privilege, No Auth, High impact on Confidentiality/Integrity/Availability). Exploitation is remot...

HotelDruid SQL Injection Vulnerability

HotelDruid is a hotel management system by the Digitaldruid.net team. The system includes features such as room management, financial management and inventory management. A security vulnerability exists in HotelDruid version v3.0.5, which originates from a cross-site scripting XSS vulnerability i...

CVE-2023-43371

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php...

CVE-2023-43373

CVE-2023-43373 affects Hoteldruid v3.0.5. A SQL injection vulnerability exists via the n_utente_agg parameter on the /hoteldruid/interconnessioni.php endpoint (CWE-89). Documents specify risk of arbitrary SQL execution with potential data access; no explicit exploitation details provided in the i...

CVE-2023-43376

CVE-2023-43376 describes a cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5, exploitable via the nometipotariffa1 parameter on the /hoteldruid/clienti.php endpoint. The issue allows attackers to run arbitrary web scripts or HTML in victims’ browsers. Official records report a CVSS v3...

CVE-2023-43374

Hoteldruid v3.0.5 contains a SQL injection vulnerability via the id_utente_log parameter in /hoteldruid/personalizza.php (CVE-2023-43374). CVSS v3.1 base score 9.8 (critical); attack vector NETWORK; no user interaction; high impact to confidentiality, integrity, and availability. Root cause: impr...