Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
digitaldruid hoteldruid vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2019-9086
HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter.
Digitaldruid Hoteldruid
NA
CVE-2023-47164
Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and previous versions allows a remote unauthenticated malicious user to execute an arbitrary script on the web browser of the user who is logging in to the product.
Digitaldruid Hoteldruid
NA
CVE-2021-42948
HotelDruid Hotel Management Software v3.0.3 and below exists to have exposed session tokens in multiple links via GET parameters, allowing malicious users to access user session id's.
Digitaldruid Hoteldruid
2 Github repositories
7.5
CVSSv2
CVE-2018-1000871
HotelDruid HotelDruid 2.3.0 version 2.3.0 and previous versions contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can result in An attacker can dump all the database records of backend webserver. This attack appear to b...
Digitaldruid Hoteldruid
4
CVSSv2
CVE-2019-9084
In Hoteldruid prior to 2.3.1, a division by zero exists in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to ...
Digitaldruid Hoteldruid
4
CVSSv2
CVE-2019-9085
Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contratto.php with invalid arguments (any non-numeric value), as demonstrated by the anno=2019&id_transazione=1&numero_...
Digitaldruid Hoteldruid
7.5
CVSSv2
CVE-2019-9087
HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter.
Digitaldruid Hoteldruid
4.3
CVSSv2
CVE-2019-8937
HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.
Digitaldruid Hoteldruid 2.3.0
1 EDB exploit
7.5
CVSSv2
CVE-2021-37832
A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter.
Digitaldruid Hoteldruid 3.0.2
2 Github repositories
NA
CVE-2023-34537
A Reflected XSS exists in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
Digitaldruid Hoteldruid 3.0.5
1 Github repository
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3581
reflected XSS
CVE-2024-26925
CVE-2024-27956
LFI
CVE-2024-3607
CVE-2024-3107
CVE-2024-3295
SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »