CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 反射型跨站脚本漏洞 Hotel Druid 应用程序 3.0.2 版本的多个页面中存在反射型跨站脚本漏洞，可导致任意执行 JavaScript 命令。 https://vulners.com/cve/CVE-2021-37833 存在漏洞的 PHP 页面： creamodelli.php - cambiafrasi 参数 visualizzatabelle.php - 任意 URL 参数 tabella.php - 任意 URL 参数 storiasoldi.php - 任意 URL 参数 漏洞 Payload...

EUVD-2026-96223

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-95684 VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachmentsname' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-95684

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.15 . The flaw resides in the 'attachments[name]' parameter due to insufficient input sanitization and output escaping . This allows unauthentic...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - 远程代码执行 RCE 由 kaal 开发的漏洞利用程序 漏洞利用程序 1. HotelDruidExploit.py 此漏洞利用程序将创建一个新房间，并以我们的 PHP 负载作为房间名称。 用法： $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2. HotelDruidExploitRoom.py 此漏洞利用程序在您已知房间名称时有效。 用法： $ ./HotelDruidExploitRoom.p...

Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion

The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server id: CVE-2023-5991 info: name: Hotel Booking...

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - 位于 update.php 中 "id" 参数的 SQL 注入漏洞 描述 ：Hotel Booking Management v1.0 被发现存在通过 update.php 中 id 参数的 SQL 注入漏洞。 受影响的产品版本 ：Hotel Booking Management v1.0 CVE 作者 ：Geraldo Alcântara 日期 ：28/11/2023 确认日期 ：19/12/2023 CVE ：CVE-2023-49989 测试环境 ：Windows 复现步骤：...

CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL注入漏洞 Hotel Druid 3.0.2 版本在使用 SQLite 作为应用数据库时存在 SQL 注入漏洞。恶意攻击者可以通过存在漏洞的 idappartamenti 参数向 SQLite 数据库发送 SQL 命令。 https://vulners.com/cve/CVE-2021-37832 https://nvd.nist.gov/vuln/detail/CVE-2021-37832match-6858716 存在漏洞的 PHP 页面： modificaapp.php - idappartamenti 参数...

CVE-2023-29839

CVE-2023-29839 Hotel Druid 3.0.4 Stored Cross Site Scripting Vulnerability CMS Link: https://www.hoteldruid.com/ Version Affected: 3.0.4 Severity & CVSS: 5.4 Medium | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N A Stored Cross Site Scripting XSS vulnerability exists in multiple pages in...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.15...

CVE-2026-95591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14...

CVE-2026-95591

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions up to and including 1.8.14 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to execute arbitrary scr...

EUVD-2026-95601

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14...

CVE-2026-95591 WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14...

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...

PT-2026-108839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14...

HotelDruid-CVE-2021-42949

CVE-2021-42949 HotelDruid 酒店管理软件 v3.0.3 中的 controllalogin 函数组件会生成可预测的会话令牌，使攻击者能够通过暴力破解攻击绕过身份验证。 会话 ID 在每次登录时动态创建，使用以下通用语法：日期时间100000-999999递增的登录尝试次数。这些值可以被相对快速地猜测和/或暴力破解。会话 ID 与存储的其他数据（remoteaddr 和 user-agent）相关联，这在一定程度上缓解了此问题；然而，用户代理可以被猜测/获知，而 remoteaddr 可以通过使用与易受攻击会话相同的计算机来绕过，和/或如果 Web...

CVE-2026-10289-XSS

酒店与旅游预订系统 - 存储型跨站脚本（XSS） 漏洞详情 字段| 详情 ---|--- 标题| 酒店与旅游预订系统 - 存储型跨站脚本（XSS） CVE ID| 待分配 厂商| code-projects.org 厂商 URL| https://code-projects.org/hotel-and-tourism-reservation-in-php-with-source-code/ 产品| 酒店与旅游预订系统 版本| 1.0 漏洞类型| 存储型跨站脚本 CWE| CWE-79 CVSS 评分| 8.3（高危） CVSS 向量|...