32 matches found
CVE-2022-22909
CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...
CVE-2022-22909
CVE-2022-22909 Description A Code Injection vulnerability has been found on the Hotel Druid v3.0.3 application, which an attacker could exploit to execute remote code on the server. For a successful exploitation, an attacker should have the privilege to add a new room. Vulnerability description T...
PT-2026-86572
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description Remote SQL injection is possible through the manipulation of the room name variable within the mysqli query function located in the /admin/modal add room.php file. SQL...
CVE-2026-35624 OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms...
CVE-2026-35624 OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms...
CVE-2026-35624 OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms...
PT-2026-31760
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw contains a policy confusion vulnerability in room authorization. The issue occurs because the software matches colliding room names instead of stable room tokens. This allows attackers ...
EUVD-2023-2524
Malicious code in bioql PyPI...
CVE-2024-42771
A Stored Cross Site Scripting XSS vulnerability was found in " /admin/editroomcontroller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "roomname" parameter...
CVE-2024-42771
The Kashipara Hotel Management System v1.0 is affected by a Stored Cross Site Scripting (XSS) vulnerability in the /admin/edit_room_controller.php endpoint. The root cause is the lack of effective filtering and escaping of user-supplied data within the room_name parameter. A remote attacker can e...
PT-2024-30142 · Unknown · Kashipara Hotel Management System
Name of the Vulnerable Software and Affected Versions: Kashipara Hotel Management System version 1.0 Description: A Stored Cross Site Scripting XSS issue was found in the "/admin/edit room controller.php" endpoint of the Kashipara Hotel Management System, allowing remote attackers to execute...
Kashipara Hotel Management System 安全漏洞
Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Hotel Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the roomname parameter of...
Cros secrets may be disclosed to untrusted relay
An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
Design/Logic Flaw
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
CVE-2023-43617: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
PT-2023-28878
Name of the Vulnerable Software and Affected Versions Croc versions prior to 9.6.16 Description An issue was discovered in Croc where parts of a custom shared secret may be divulged to an untrusted Relay when composing a room name. This occurs when a custom shared secret is used. Recommendations...
