PatchTheCVEhoteldruid vulnerabilities and fixes
Recent CVEs affecting hoteldruid, with upgrade or downgrade steps. 6 tracked.
hoteldruid has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-06-20. Highest priority: CVE-2024-23091 (score 45/100).
- CVE-2025-44203 HIGH 7.5 DOWNGRADE In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before se
- CVE-2025-25749 HIGH 7.1 UPGRADE An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforce
- CVE-2025-25748 HIGH 7.3 DOWNGRADE A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unaut
- CVE-2025-25747 MEDIUM 5.4 DOWNGRADE Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary
- CVE-2024-23091 HIGH 7.5 UPGRADE Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plainte
- CVE-2023-43378 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scri
FAQ
How do I fix hoteldruid vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is hoteldruid being exploited right now?
None of the tracked hoteldruid CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which hoteldruid CVE should I patch first?
CVE-2024-23091 currently ranks highest (45/100): Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plainte.