472 matches found
CVE-2019-9086
HotelDruid before v2.3.1 has SQL Injection via the /visualizzatabelle.php anno parameter...
CVE-2019-9087
HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter...
CVE-2019-9087
HotelDruid before v2.3.1 is vulnerable to SQL Injection via the /tab_tariffe.php?numtariffa1 parameter. The root cause is improper input handling in HotelDruid’s web interface, enabling attacker-controlled SQL execution. The CVSS metrics indicate a high/critical impact profile (CVSSv2: base 7.5, ...
CVE-2019-9087
HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter...
CVE-2019-9087
HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter...
CVE-2019-9084
In Hoteldruid before 2.3.1, a division by zero was discovered in $numtabelle in tabtariffe.php aka the numtariffa1 parameter due to the mishandling of non-numeric values, as demonstrated by the /tabtariffe.php?anno=YEAR&numtariffa1=1a URI. It could allow an administrator to conduct remote denial ...
CVE-2019-9084
The vulnerability CVE-2019-9084 affects Hoteldruid before 2.3.1, where a division-by-zero can occur in tab_tariffe.php (variable $num_tabelle / numtariffa1) when non-numeric values are supplied (e.g., /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a). This is caused by mishandling non-numeric input an...
CVE-2019-9084
In Hoteldruid before 2.3.1, a division by zero was discovered in $numtabelle in tabtariffe.php aka the numtariffa1 parameter due to the mishandling of non-numeric values, as demonstrated by the /tabtariffe.php?anno=YEAR&numtariffa1=1a URI. It could allow an administrator to conduct remote denial ...
CVE-2019-9084
In Hoteldruid before 2.3.1, a division by zero was discovered in $numtabelle in tabtariffe.php aka the numtariffa1 parameter due to the mishandling of non-numeric values, as demonstrated by the /tabtariffe.php?anno=YEAR&numtariffa1=1a URI. It could allow an administrator to conduct remote denial ...
PT-2019-19353
Name of the Vulnerable Software and Affected Versions Hoteldruid versions prior to 2.3.1 Description A division by zero issue was found due to the mishandling of non-numeric values in the numtariffa1 parameter of the tab tariffe.php file. This could allow an administrator to conduct a remote deni...
CVE-2019-9086: Improper Neutralization of Special Elements used in an SQL Command
HotelDruid before v2.3.1 has SQL Injection via the /visualizzatabelle.php anno parameter...
CVE-2019-9087: Improper Neutralization of Special Elements used in an SQL Command
HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter...
PT-2019-19355
Name of the Vulnerable Software and Affected Versions HotelDruid versions prior to 2.3.1 Description The issue is related to SQL Injection, which can be exploited via the "anno" parameter in the /visualizza tabelle.php endpoint. Recommendations For versions prior to 2.3.1, update to version 2.3.1...
CVE-2019-9084: Divide By Zero
In Hoteldruid before 2.3.1, a division by zero was discovered in $numtabelle in tabtariffe.php aka the numtariffa1 parameter due to the mishandling of non-numeric values, as demonstrated by the /tabtariffe.php?anno=YEAR&numtariffa1=1a URI. It could allow an administrator to conduct remote denial ...
PT-2019-19356
Name of the Vulnerable Software and Affected Versions HotelDruid versions prior to 2.3.1 Description The issue is related to SQL Injection, which can be exploited via the "numtariffa1" parameter in the "/tab tariffe.php" API endpoint. Recommendations For versions prior to 2.3.1, update to version...
Design/Logic Flaw
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php...
CVE-2019-8937
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php...
CVE-2019-8937
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php...
