CVE-2525-25748-Cross-Site-Request-Forgery-CSRF-Vulnerability-in-HotelDruid-3.0.7

CVE-2025-25748-Vulnerabilidad-de-Cross-Site-Request-Forgery-CSRF-en-HotelDruid-3.0.7 Descripción Una vulnerabilidad de Cross Site Request Forgery CSRF en el endpoint gestioneutenti.php de HotelDruid 3.0.7 permite a los atacantes realizar acciones no autorizadas por ejemplo, modificar contraseñas ...

CVE-2025-55816

CVE-2025-55816 CVE-2025-55816 HotelDruid 3.0.7 Author: partywave Collab: Raptx team External references HotelDruid 3.0.8 changelog CVE blogpost Raptx site Vulnerability The vulnerability is a simple Stored Cross Site Scripting XSS in /modificaapp.php endpoint. The attacker can insert a javascript...

CVE-2025-44203

CVE-2025-44203: HotelDruid 3.0.0 / 3.0.7 Sensitive Information Disclosure and DoS Summary HotelDruid 3.0.0 and 3.0.7 contain a race condition on the creadb.php setup endpoint, reachable before the setup is finished. It has two impacts, and both come from the same lost race: a sensitive informatio...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Vulnerabilidad XSS Reflejado en HotelDruid 3.0.7 Descripción Vulnerabilidad de Cross Site Scripting en DigitalDruid HotelDruid v.3.0.7 permite a un atacante ejecutar código arbitrario y obtener información sensible a través del parámetro ripristinabackup en el endpoint...

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the nutenteagg parameter at /hoteldruid/interconnessioni.php. id: CVE-2023-43373 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

Hoteldruid v3.0.5 - SQL Injection

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the idutentelog parameter at /hoteldruid/personalizza.php. id: CVE-2023-43374 info: name: Hoteldruid v3.0.5 - SQL Injection author: ritikchaddha severity: critical description: | Hoteldruid v3.0.5 was discovered to...

HotelDruid 2.3.0 - Cross-Site Scripting

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. id: CVE-2019-8937 info: name: HotelDruid 2.3.0 - Cross-Site Scripting author: LogicalHunte...

Hotel Druid 3.0.2 - Cross-Site Scripting

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. id: CVE-2021-37833 info: name: Hotel Druid 3.0.2 - Cross-Site Scripting author: pikpikcu,s4e-io severity: medium description: Hotel Druid 3.0.2 contains a...

Hoteldruid 3.0.5 - Cross-Site Scripting

A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data. id: CVE-2023-34537 info: name: Hoteldruid 3.0.5 - Cross-Site Scripting author: Harsh severity: medium...

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7 Description A vulnerability in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. Impact Weak Passwords Accepted: Attackers can guess simple passwords or use...

HotelDruid-CVE-2021-42949

CVE-2021-42949 La funzione controllalogin nel componente HotelDruid Hotel Management Software v3.0.3 genera un token di sessione prevedibile, consentendo agli aggressori di bypassare l'autenticazione tramite attacchi di forza bruta. L'ID di sessione viene creato dinamicamente a ogni accesso...

HotelDruid-CVE-2021-42948

CVE-2021-42948 Bei HotelDruid Hotel Management Software v3.0.3 und früheren Versionen wurde festgestellt, dass Sitzungstoken in mehreren Links über GET-Parameter offengelegt werden, wodurch Angreifer auf Benutzersitzungs-IDs zugreifen können. Das Sitzungstoken, das für den Zugriff auf...

CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5

CVE-2023-34537--- XSS riflesso trovato in HotelDruid V3.0.5 HotelDruid v3.0.5 è vulnerabile a molteplici vulnerabilità XSS. Queste vulnerabilità potrebbero consentire a utenti autenticati remoti di iniettare script web o HTML arbitrari. Questa è la mia terza repository. Non prendetevela con me se...

CVE-2023-33817---SQL-Injection-found-in-HotelDruid-3.0.5

CVE-2023-33817 - SQL Injection trovata in HotelDruid V3.0.5 HotelDruid v3.0.5 è vulnerabile a SQL injection. Un attaccante potrebbe eseguire comandi SQL arbitrari per recuperare dati dai database o addirittura eseguire codice in remoto sul sistema di database di destinazione. Questa è la mia...

CVE-2023-43375

Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, linguacli, mesenascita, and mesescaddoc parameters...

CVE-2023-43371

Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php...

CVE-2023-43376

A cross-site scripting XSS vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter...

CVE-2022-26564

HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...

CVE-2025-55816

HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting XSS in the /modificaapp.php file...

Linux Distros Unpatched Vulnerability : CVE-2025-55816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting XSS in the /modificaapp.php file. CVE-2025-55816 Note that Nessus relies on the presence of t...