WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product druid✕
Overview 8 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
8matches 1in Waratek scope12.5% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 12.5% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 7 87.5% Withdrawn CVE 0 0.0%
Critical 2 25.0% High 1 12.5% Medium 5 62.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 8 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 7Mitigation candidate: 1 Medium: 5High: 1Critical: 2 not blocked: 8 Working exploit published: 8
Q2 191 Not applicable1 Medium1 not blocked1 Working exploit published1 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 211 Not applicable1 Medium1 not blocked1 Working exploit published1 Q4 210 Q1 221 Not applicable1 High1 not blocked1 Working exploit published1 Q2 221 Not applicable1 Medium1 not blocked1 Working exploit published1 Q3 220 Q4 220 Q1 230 Q2 231 Not applicable1 Medium1 not blocked1 Working exploit published1 Q3 232 Not applicable2 Critical2 not blocked2 Working exploit published2 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 251 Mitigation candidate1 Medium1 not blocked1 Working exploit published1
Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-27888 Medium 2025-03-20 Mitigation candidate Working exploit published Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.
CVE-2023-43374 Critical 2023-09-20 Not applicable Working exploit published Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
CVE-2023-43373 Critical 2023-09-20 Not applicable Working exploit published Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
CVE-2023-34537 Medium 2023-06-13 Not applicable Working exploit published A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
CVE-2022-26564 Medium 2022-04-26 Not applicable Working exploit published HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.
CVE-2022-22909 High 2022-03-03 Not applicable Working exploit published HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVE-2021-37833 Medium 2021-08-03 Not applicable Working exploit published A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands.
CVE-2019-8937 Medium 2019-05-17 Not applicable Working exploit published HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.