hotel management system vulnerabilities and fixes

Recent CVEs affecting hotel management system, with upgrade or downgrade steps. 25 tracked.

Also searched as: hotelmanagementsystem.

hotel management system has 25 tracked vulnerabilities, 7 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-12-18. Highest priority: CVE-2024-42558 (score 58/100).

• CVE-2025-63949 MEDIUM 6.1 DOWNGRADE A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allo
• CVE-2025-4500 MEDIUM 5.3 DOWNGRADE A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0
• CVE-2024-42776 HIGH 7.2 DOWNGRADE Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.
• CVE-2024-42775 CRITICAL 9.1 DOWNGRADE An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Manag
• CVE-2024-42774 HIGH 7.5 DOWNGRADE An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management Sy
• CVE-2024-42773 CRITICAL 9.1 DOWNGRADE An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Mana
• CVE-2024-42772 HIGH 7.5 DOWNGRADE An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v
• CVE-2024-42771 MEDIUM 4.8 DOWNGRADE A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashi
• CVE-2024-42770 MEDIUM 4.7 DOWNGRADE A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Mana
• CVE-2024-42769 MEDIUM 6.1 DOWNGRADE A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel
• CVE-2024-42768 MEDIUM 6.8 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /adm
• CVE-2024-42767 HIGH 7.2 DOWNGRADE Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_contr
• CVE-2024-42558 CRITICAL 9.8 UPGRADE Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id
• CVE-2024-42557 HIGH 8.8 UPGRADE A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 9
• CVE-2024-42556 CRITICAL 9.8 UPGRADE Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_ty
• CVE-2024-42555 HIGH 8.8 UPGRADE A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit
• CVE-2024-42554 HIGH 8.8 UPGRADE Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_ty
• CVE-2024-42553 HIGH 8.8 UPGRADE A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91
• CVE-2024-42552 HIGH 8.6 UPGRADE Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id
• CVE-2024-25318 HIGH 8.8 DOWNGRADE Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php
• CVE-2024-25316 CRITICAL 9.8 DOWNGRADE Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersetti
• CVE-2024-25315 CRITICAL 9.8 DOWNGRADE Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook
• CVE-2024-25314 CRITICAL 9.8 DOWNGRADE Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php
• CVE-2024-12186 MEDIUM 5.3 DOWNGRADE A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic
• CVE-2024-12185 MEDIUM 5.3 DOWNGRADE A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic

FAQ

How do I fix hotel management system vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is hotel management system being exploited right now?

None of the tracked hotel management system CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which hotel management system CVE should I patch first?

CVE-2024-42558 currently ranks highest (58/100): Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id.

RSS feed for hotel management system · ← Back to latest CVEs