Hoteldruid Security Vulnerabilities and Issues — Hoteldruid CVE List

Lucene search

DigitaldruidHoteldruid

4 matches found

CVE•added 2025/04/22 6:15 p.m.•73 views

CVE-2023-43378

A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter.

6.1CVSS5.9AI score0.00051EPSS

CVE•added 2025/03/11 4:15 p.m.•54 views

CVE-2025-25747

Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint

5.4CVSS7AI score0.00073EPSS

CVE•added 2025/03/11 6:15 p.m.•42 views

CVE-2025-25749

An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

7.1CVSS7.1AI score0.00236EPSS

CVE•added 2025/06/20 4:15 p.m.•9 views

CVE-2025-44203

In HotelDruid 3.0.7, an unauthenticated attacker can exploit verbose SQL error messages on creadb.php before the 'create database' button is pressed. By sending malformed POST requests to this endpoint, the attacker may obtain the administrator username, password hash, and salt. In some cases, the ...

7.5CVSS7.3AI score0.00026EPSS