Overview 31 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 7 public PoC · 0 EPSS ≥ 0.5
31matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
7public PoC22.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
31
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
31
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
7
22.6%
Proof of concept only
11
35.5%
Forecast only
0
0.0%
No public exploit
13
41.9%
split by
peak 10 / year
20181
Not applicable1
Critical1
not blocked1
No public exploit1
20195
Not applicable5
Critical2
Medium3
not blocked5
Working exploit published1
No public exploit4
20200
20214
Not applicable4
Critical1
High1
Medium2
not blocked4
Working exploit published1
No public exploit3
20224
Not applicable4
Critical1
High1
Medium1
Low1
not blocked4
Working exploit published2
No public exploit2
202310
Not applicable10
Critical4
High1
Medium5
not blocked10
Working exploit published3
Proof of concept only5
No public exploit2
20241
Not applicable1
High1
not blocked1
No public exploit1
20256
Not applicable6
High3
Medium3
not blocked6
Proof of concept only6
20182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-55816 | Medium | 2025-12-11 | Not applicable | Proof of concept only | HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file. |
| CVE-2025-44203 | High | 2025-06-20 | Not applicable | Proof of concept only | In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator username, password hash, and salt. The same race leaves the setup partially initialized, so the administrator can no longer log in with the credentials set during installation, resulting in a denial of service that requires reinstallation to recover. Remote exploitation additionally requires the installation to allow non-localhost access. The vulnerability was fixed in version 3.0.8. |
| CVE-2023-43378 | Medium | 2025-04-22 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter. |
| CVE-2025-25749 | High | 2025-03-11 | Not applicable | Proof of concept only | An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. |
| CVE-2025-25748 | High | 2025-03-11 | Not applicable | Proof of concept only | A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token. |
| CVE-2025-25747 | Medium | 2025-03-11 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint |
| CVE-2024-23091 | High | 2024-07-30 | Not applicable | No public exploit | Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. |
| CVE-2023-47164 | Medium | 2023-11-10 | Not applicable | No public exploit | Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product. |
| CVE-2023-43377 | Medium | 2023-09-20 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the destinatario_email1 parameter. |
| CVE-2023-43376 | Medium | 2023-09-20 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the nometipotariffa1 parameter. |
| CVE-2023-43375 | Critical | 2023-09-20 | Not applicable | No public exploit | Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters. |
| CVE-2023-43374 | Critical | 2023-09-20 | Not applicable | Working exploit published | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php. |
| CVE-2023-43373 | Critical | 2023-09-20 | Not applicable | Working exploit published | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php. |
| CVE-2023-43371 | Critical | 2023-09-20 | Not applicable | Proof of concept only | Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php. |
| CVE-2023-34537 | Medium | 2023-06-13 | Not applicable | Working exploit published | A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data. |
| CVE-2023-33817 | High | 2023-06-13 | Not applicable | Proof of concept only | hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability. |
| CVE-2023-29839 | Medium | 2023-05-03 | Not applicable | Proof of concept only | A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function. |
| CVE-2021-42949 | Critical | 2022-09-16 | Not applicable | No public exploit | The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks. |
| CVE-2021-42948 | Low | 2022-09-16 | Not applicable | No public exploit | HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. |
| CVE-2022-26564 | Medium | 2022-04-26 | Not applicable | Working exploit published | HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. |
| CVE-2022-22909 | High | 2022-03-03 | Not applicable | Working exploit published | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. |
| CVE-2021-33800 | High | 2021-11-03 | Not applicable | No public exploit | In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. |
| CVE-2021-38559 | Medium | 2021-08-26 | Not applicable | No public exploit | DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. |
| CVE-2021-37833 | Medium | 2021-08-03 | Not applicable | Working exploit published | A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands. |
| CVE-2021-37832 | Critical | 2021-08-03 | Not applicable | No public exploit | A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter. |
| CVE-2019-9085 | Medium | 2019-06-24 | Not applicable | No public exploit | Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service (invoice-creation outage) via the n_file parameter to visualizza_contratto.php with invalid arguments (any non-numeric value), as demonstrated by the anno=2019&id_transazione=1&numero_contratto=1&n_file=a query string to visualizza_contratto.php. |
| CVE-2019-9087 | Critical | 2019-06-07 | Not applicable | No public exploit | HotelDruid before v2.3.1 has SQL Injection via the /tab_tariffe.php numtariffa1 parameter. |
| CVE-2019-9086 | Critical | 2019-06-07 | Not applicable | No public exploit | HotelDruid before v2.3.1 has SQL Injection via the /visualizza_tabelle.php anno parameter. |
| CVE-2019-9084 | Medium | 2019-06-07 | Not applicable | No public exploit | In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 parameter) due to the mishandling of non-numeric values, as demonstrated by the /tab_tariffe.php?anno=[YEAR]&numtariffa1=1a URI. It could allow an administrator to conduct remote denial of service (disrupting certain business functions of the product). |
| CVE-2019-8937 | Medium | 2019-05-17 | Not applicable | Working exploit published | HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php. |
| CVE-2018-1000871 | Critical | 2018-12-20 | Not applicable | No public exploit | HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can result in An attacker can dump all the database records of backend webserver. This attack appear to be exploitable via the attack can be done by anyone via specially crafted sql query passed to the "id_utente_mod=1" parameter. |