https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63949.htmlhttps://patchthecve.com/cve/CVE-2025-63949.htmlTue, 13 Oct 2026 11:10:00 +0000MEDIUM 6.1: A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php.https://patchthecve.com/cve/CVE-2025-4500.htmlhttps://patchthecve.com/cve/CVE-2025-4500.htmlWed, 17 Jun 2026 09:33:23 +0000MEDIUM 5.3: A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is the function Edit of the component Edit Room. The manipulation of the argument roomnumber leads to stack-based buffer overflow. An attack has to be approached lochttps://patchthecve.com/cve/CVE-2024-12186.htmlhttps://patchthecve.com/cve/CVE-2024-12186.htmlWed, 17 Jun 2026 06:59:12 +0000MEDIUM 5.3: A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file hotelnew.c of the component Available Room Handler. The manipulation of the argument admin_entry leads to stack-based buffer overflow. Local achttps://patchthecve.com/cve/CVE-2024-12185.htmlhttps://patchthecve.com/cve/CVE-2024-12185.htmlWed, 17 Jun 2026 06:59:12 +0000MEDIUM 5.3: A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Administrator Login Password Handler. The manipulation of the argument Str2 leads to stack-based buffer overflow. An attack has to be aphttps://patchthecve.com/cve/CVE-2024-42773.htmlhttps://patchthecve.com/cve/CVE-2024-42773.htmlWed, 17 Jun 2026 07:49:58 +0000CRITICAL 9.1: An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.https://patchthecve.com/cve/CVE-2024-42767.htmlhttps://patchthecve.com/cve/CVE-2024-42767.htmlWed, 17 Jun 2026 07:49:57 +0000HIGH 7.2: Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.https://patchthecve.com/cve/CVE-2024-42776.htmlhttps://patchthecve.com/cve/CVE-2024-42776.htmlWed, 17 Jun 2026 07:49:59 +0000HIGH 7.2: Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.https://patchthecve.com/cve/CVE-2024-42775.htmlhttps://patchthecve.com/cve/CVE-2024-42775.htmlWed, 17 Jun 2026 07:49:59 +0000CRITICAL 9.1: An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.https://patchthecve.com/cve/CVE-2024-42774.htmlhttps://patchthecve.com/cve/CVE-2024-42774.htmlWed, 17 Jun 2026 07:49:59 +0000HIGH 7.5: An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.https://patchthecve.com/cve/CVE-2024-42772.htmlhttps://patchthecve.com/cve/CVE-2024-42772.htmlWed, 17 Jun 2026 07:49:58 +0000HIGH 7.5: An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section.https://patchthecve.com/cve/CVE-2024-42768.htmlhttps://patchthecve.com/cve/CVE-2024-42768.htmlWed, 17 Jun 2026 07:49:58 +0000MEDIUM 6.8: A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php.https://patchthecve.com/cve/CVE-2024-42771.htmlhttps://patchthecve.com/cve/CVE-2024-42771.htmlWed, 17 Jun 2026 07:49:58 +0000MEDIUM 4.8: A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter.https://patchthecve.com/cve/CVE-2024-42770.htmlhttps://patchthecve.com/cve/CVE-2024-42770.htmlWed, 17 Jun 2026 07:49:58 +0000MEDIUM 4.7: A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter.https://patchthecve.com/cve/CVE-2024-42769.htmlhttps://patchthecve.com/cve/CVE-2024-42769.htmlWed, 17 Jun 2026 07:49:58 +0000MEDIUM 6.1: A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters.https://patchthecve.com/cve/CVE-2024-42558.htmlhttps://patchthecve.com/cve/CVE-2024-42558.htmlWed, 17 Jun 2026 07:49:38 +0000CRITICAL 9.8: Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.https://patchthecve.com/cve/CVE-2024-42557.htmlhttps://patchthecve.com/cve/CVE-2024-42557.htmlWed, 17 Jun 2026 07:49:38 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.https://patchthecve.com/cve/CVE-2024-42556.htmlhttps://patchthecve.com/cve/CVE-2024-42556.htmlWed, 17 Jun 2026 07:49:38 +0000CRITICAL 9.8: Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_removed.php.https://patchthecve.com/cve/CVE-2024-42555.htmlhttps://patchthecve.com/cve/CVE-2024-42555.htmlWed, 17 Jun 2026 07:49:37 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.https://patchthecve.com/cve/CVE-2024-42554.htmlhttps://patchthecve.com/cve/CVE-2024-42554.htmlWed, 17 Jun 2026 07:49:37 +0000HIGH 8.8: Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_added.php.https://patchthecve.com/cve/CVE-2024-42553.htmlhttps://patchthecve.com/cve/CVE-2024-42553.htmlWed, 17 Jun 2026 07:49:37 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to escalate privileges.https://patchthecve.com/cve/CVE-2024-42552.htmlhttps://patchthecve.com/cve/CVE-2024-42552.htmlWed, 17 Jun 2026 07:49:37 +0000HIGH 8.6: Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_history.php.https://patchthecve.com/cve/CVE-2024-25318.htmlhttps://patchthecve.com/cve/CVE-2024-25318.htmlWed, 17 Jun 2026 07:15:52 +0000HIGH 8.8: Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.https://patchthecve.com/cve/CVE-2024-25316.htmlhttps://patchthecve.com/cve/CVE-2024-25316.htmlWed, 17 Jun 2026 07:15:51 +0000CRITICAL 9.8: Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2.https://patchthecve.com/cve/CVE-2024-25315.htmlhttps://patchthecve.com/cve/CVE-2024-25315.htmlWed, 17 Jun 2026 07:15:51 +0000CRITICAL 9.8: Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.https://patchthecve.com/cve/CVE-2024-25314.htmlhttps://patchthecve.com/cve/CVE-2024-25314.htmlWed, 17 Jun 2026 07:15:51 +0000CRITICAL 9.8: Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.https://patchthecve.com/cve/CVE-2023-49272.htmlhttps://patchthecve.com/cve/CVE-2023-49272.htmlWed, 17 Jun 2026 06:35:44 +0000MEDIUM 5.4: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.https://patchthecve.com/cve/CVE-2023-49271.htmlhttps://patchthecve.com/cve/CVE-2023-49271.htmlWed, 17 Jun 2026 06:35:44 +0000MEDIUM 5.4: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.https://patchthecve.com/cve/CVE-2023-49270.htmlhttps://patchthecve.com/cve/CVE-2023-49270.htmlWed, 17 Jun 2026 06:35:43 +0000MEDIUM 5.4: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.https://patchthecve.com/cve/CVE-2023-49269.htmlhttps://patchthecve.com/cve/CVE-2023-49269.htmlWed, 17 Jun 2026 06:35:43 +0000MEDIUM 5.4: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response.