Lucene search
+L

3517 matches found

Kitploit
Kitploit
added 2026/09/20 6:04 a.m.8 views

CVE-2024-10410

Código fuente Online Hotel Reservation System en PHP/MySQLi con Código Fuente | SourceCodester Descripción Se encontró una vulnerabilidad de alto riesgo en Online Hotel Reservation System, que afecta a la función de carga del archivo /marimar/admin/modroom/controller.php. La operación de evasión ...

7.2CVSS6.5AI score0.01151EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/20 5:37 a.m.10 views

CVE-2026-14762-PoC-Exploit

CVE-2026-14762 – Code‑Projects Hotel & Tourism Reservation 1.0 SQL Injection Exploit -orange -red Fully featured, multi‑threaded, time‑based blind SQL injection exploit for CVE‑2026‑14762. Targets the /admin/rooms.php endpoint of the Code‑Projects Hotel & Tourism Reservation application version...

7.5CVSS8AI score0.00431EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/20 12:17 a.m.11 views

CVE-2023-49988

CVE-2023-49988 Hotel Booking Management v1.0 - Vulnerabilidad de inyección SQL en el parámetro "npss" en rooms.php Descripción : Existe una vulnerabilidad de inyección SQL en la versión 1 de Hotel Booking Management. Un atacante malicioso puede ejecutar comandos SQL en la base de datos MySQL al...

7.5CVSS6.1AI score0.0068EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/19 7:46 p.m.10 views

CVE-2021-41651

CVE-2021-41651 CVE-2021-41651 SQL Injection in hotel-mgmt-system The hotel-mgmt-system is vulnerable to un-authenticated time based blind SQL Injection attack. The cid parameter on the /processupdateprofile.php page does not sanitize the user input, an attacker can extract sensisitive data from t...

7.5CVSS7.5AI score0.02377EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/19 2:10 p.m.12 views

CVE-2023-29839

Vulnerabilidad de Cross Site Scripting Almacenado en Hotel Druid 3.0.4 - CVE-2023-29839 Enlace del CMS: https://www.hoteldruid.com/ Versión afectada: 3.0.4 Gravedad y CVSS: 5.4 Media | Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Existe una vulnerabilidad de Cross Site Scripting XSS...

5.4CVSS6.3AI score0.00663EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/19 12:58 p.m.8 views

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Ejecución Remota de Código RCE Exploit por kaal Exploits 1. HotelDruidExploit.py Este exploit creará una nueva habitación con nuestro payload PHP como nombre de habitación. Uso: $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid ...

8.8CVSS8AI score0.45434EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/19 9:43 a.m.9 views

CVE-2021-37832

CVE 2021-37832 Vulnerabilidad de Inyección SQL en Hotel Druid 3.0.2 Existe una vulnerabilidad de inyección SQL en la versión 3.0.2 de Hotel Druid cuando se usa SQLite como base de datos de la aplicación. Un atacante malicioso puede ejecutar comandos SQL en la base de datos SQLite a través del...

9.8CVSS8.3AI score0.04102EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/19 9:22 a.m.10 views

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Vulnerabilidad de Cross Site Scripting Reflejado Existe una vulnerabilidad de Cross Site Scripting reflejado en múltiples páginas de la versión 3.0.2 de la aplicación Hotel Druid que permite la ejecución arbitraria de comandos JavaScript...

6.1CVSS6.6AI score0.04878EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/19 5:14 a.m.8 views

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - Vulnerabilidad de Inyección SQL en el parámetro "id" en update.php Descripción : Se descubrió que Hotel Booking Management v1.0 contenía una vulnerabilidad de inyección SQL a través del parámetro id en update.php. Versión del producto vulnerable :...

9.8CVSS6AI score0.00784EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.30 views

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

6.1CVSS5.9AI score0.00686EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.38 views

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...

9.8CVSS8.7AI score0.16017EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.21 views

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...

9.8CVSS8.2AI score0.63711EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.98 views

Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion

The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server id: CVE-2023-5991 info: name: Hotel Booking...

9.8CVSS8.2AI score0.03313EPSS
SaveExploits2References2
EUVD
EUVD
added 2026/09/18 6:00 a.m.6 views

EUVD-2026-82667

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

8.8CVSS0.00303EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/17 1:01 a.m.11 views

HotelDruid-CVE-2021-42949

CVE-2021-42949 The component controllalogin function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks. The session id is dynamically created at each login using the following generalized syntax...

9.8CVSS8.3AI score0.07119EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/17 12:57 a.m.13 views

CVE-2026-10289-XSS

Hotel and Tourism Reservation System - Stored Cross-Site Scripting XSS Vulnerability Details...

5.3CVSS5.6AI score0.00338EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/16 11:59 a.m.13 views

CVE-2024-3605

CVE-2024-3605 WP Hotel Booking = 2.1.0 - Inyección SQL no autenticada Descripción El plugin WP Hotel Booking para WordPress es vulnerable a la inyección SQL a través del parámetro 'roomtype' del endpoint /wphb/v1/rooms/search-rooms de la API REST en todas las versiones hasta la 2.1.0 incluida,...

10CVSS6AI score0.04152EPSS
SaveExploits1
NVD
NVD
added 2026/09/15 9:16 p.m.6 views

CVE-2026-92234

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

5.4CVSS0.00189EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/15 8:56 p.m.10 views

CVE-2026-92234

QloApps versions through 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page (back-office). The child_features parameter is reflected unescaped into validation error messages, allowing an authenticated back-office user who fol...

5.4CVSS5.8AI score0.00189EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/15 8:56 p.m.29 views

CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

5.4CVSS0.00189EPSS
SaveExploits0References6
Rows per page
Query Builder