WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product druid✕
Overview 9 matches · 2 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
9matches 2in Waratek scope22.2% 0protected0.0% 1exploited11.1% 0CISA KEV0.0% 2public PoC22.2% 1EPSS ≥ 0.511.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 11.1% No exploit published 1 11.1% Outside Waratek scope 0 0.0% Not applicable 7 77.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 9 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 11.1% Working exploit published 1 11.1% Proof of concept only 4 44.4% Forecast only 0 0.0% No public exploit 3 33.3%
split by peak 2 / quarter
Not applicable: 7No exploit published: 1Mitigation candidate: 1 High: 9 not blocked: 9 No public exploit: 3Proof of concept only: 4Working exploit published: 1Exploited: 1
Q1 212 Mitigation candidate1 No exploit published1 High2 not blocked2 Exploited1 No public exploit1 Q2 210 Q3 210 Q4 211 Not applicable1 High1 not blocked1 No public exploit1 Q1 221 Not applicable1 High1 not blocked1 Working exploit published1 Q2 220 Q3 220 Q4 220 Q1 230 Q2 231 Not applicable1 High1 not blocked1 Proof of concept only1 Q3 230 Q4 230 Q1 240 Q2 240 Q3 241 Not applicable1 High1 not blocked1 No public exploit1 Q4 240 Q1 252 Not applicable2 High2 not blocked2 Proof of concept only2 Q2 251 Not applicable1 High1 not blocked1 Proof of concept only1
Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-44203 High 2025-06-20 Not applicable Proof of concept only In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8.
CVE-2025-25749 High 2025-03-11 Not applicable Proof of concept only An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.
CVE-2025-25748 High 2025-03-11 Not applicable Proof of concept only A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.
CVE-2024-23091 High 2024-07-30 Not applicable No public exploit Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
CVE-2023-33817 High 2023-06-13 Not applicable Proof of concept only hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability.
CVE-2022-22909 High 2022-03-03 Not applicable Working exploit published HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.
CVE-2021-33800 High 2021-11-03 Not applicable No public exploit In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.
CVE-2021-26919 High 2021-03-30 No exploit published No public exploit Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
CVE-2021-25646 High 2021-01-29 Mitigation candidate Exploited Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.