CVE-2025-55816
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file. The vulnerability allows injection of malicious code executed in the user's browser.
Risk Assessment
An attacker can hijack a user's session, steal data, or perform actions on their behalf. The risk affects all HotelDruid application users.
Recommendation
Update HotelDruid to a version newer than 3.0.7 if available. Otherwise, consider implementing input validation or a WAF.
Other vulnerabilities in HotelDruid
See all- CVE-2023-34854Medium
HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. This may allow uploading dangerous files.
- CVE-2025-44203High
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup completion, causing a race condition during database creation. Sending many concurrent requests can disclose the administrator username, password hash, and salt, and leave the setup partially initialized, preventing login and requiring reinstallation.
- CVE-2023-34537Medium
A Reflected XSS vulnerability was discovered in HotelDruid version 3.0.5, allowing an attacker to inject malicious code into webpage parameters, potentially tricking users in their browsers or exfiltrating data.
- CVE-2023-33817High
Version 3.0.5 of hoteldruid was found to contain a SQL injection vulnerability.
Original NVD description (English source)
HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS