CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL注入漏洞 Hotel Druid 3.0.2 版本在使用 SQLite 作为应用数据库时存在 SQL 注入漏洞。恶意攻击者可以通过存在漏洞的 idappartamenti 参数向 SQLite 数据库发送 SQL 命令。 https://vulners.com/cve/CVE-2021-37832 https://nvd.nist.gov/vuln/detail/CVE-2021-37832match-6858716 存在漏洞的 PHP 页面： modificaapp.php - idappartamenti 参数...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 反射型跨站脚本漏洞 Hotel Druid 应用程序 3.0.2 版本的多个页面中存在反射型跨站脚本漏洞，可导致任意执行 JavaScript 命令。 https://vulners.com/cve/CVE-2021-37833 存在漏洞的 PHP 页面： creamodelli.php - cambiafrasi 参数 visualizzatabelle.php - 任意 URL 参数 tabella.php - 任意 URL 参数 storiasoldi.php - 任意 URL 参数 漏洞 Payload...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - 远程代码执行 RCE 由 kaal 开发的漏洞利用程序 漏洞利用程序 1. HotelDruidExploit.py 此漏洞利用程序将创建一个新房间，并以我们的 PHP 负载作为房间名称。 用法： $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2. HotelDruidExploitRoom.py 此漏洞利用程序在您已知房间名称时有效。 用法： $ ./HotelDruidExploitRoom.p...

CVE-2023-29839

CVE-2023-29839 Hotel Druid 3.0.4 存储型跨站脚本漏洞 CMS链接：https://www.hoteldruid.com/ 受影响版本：3.0.4 严重性与CVSS：5.4（中危）| 向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Hotel Druid 应用程序 3.0.4 版本的多个页面中存在存储型跨站脚本（XSS）漏洞，可导致任意命令执行。 受影响字段：在“文档”功能中的姓氏、名字、昵称 受影响链接：/visualizzacontratto.php 触发载荷：访问示例 文档预览功能 修复措施：升级至...

CVE-2022-22909

CVE-2022-22909 描述 已在 Hotel Druid v3.0.3 应用程序中发现一个代码注入漏洞，攻击者可利用该漏洞在服务器上执行远程代码。 成功利用此漏洞的前提是，攻击者必须拥有添加新客房的权限。 漏洞描述 该漏洞的产生原因是客房名称被存储到名为 /dati/selectappartamenti.php 的文件中，且使用了双引号 。 root@kitploit: Room1 Room2 Room3 "; ? Payload 要成功利用该漏洞，请添加一个客房，并将以下 Payload 作为客房名称。 root@kitploit: $system$REQUESTcmd...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

UBUNTU-CVE-2025-55816

HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting XSS in the /modificaapp.php file...

EUVD-2021-24313

Malware in sbrugna...

EUVD-2023-33376

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2019-9087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HotelDruid before v2.3.1 has SQL Injection via the /tabtariffe.php numtariffa1 parameter. CVE-2019-9087 Note that Nessus relies on the presence of the package a...

Linux Distros Unpatched Vulnerability : CVE-2019-8937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and...

CVE-2021-37832

A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter...

CVE-2021-37833

A reflected cross-site scripting XSS vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands...

HotelDruid SQL Injection Vulnerability

HotelDruid is a hotel management system by the Digitaldruid.net team. The system includes features such as room management, financial management and inventory management. A security vulnerability exists in HotelDruid version v3.0.5, which stems from a SQL injection vulnerability in the parameter...

CVE-2023-34537

A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data...

Exploit for SQL Injection in Digitaldruid Hoteldruid

CVE-2023-33817 - SQL Injection found in HotelDruid V3.0.5 Ho...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

DEBIAN-CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

Cross site scripting

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...