PatchTheCVEdigitaldruid vulnerabilities
Recent CVEs affecting digitaldruid products. 5 tracked.
digitaldruid has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-06-20. Highest priority: CVE-2025-44203 (score 43/100).
- CVE-2025-44203 HIGH 7.5 DOWNGRADE In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before se
- CVE-2025-25749 HIGH 7.1 UPGRADE An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforce
- CVE-2025-25748 HIGH 7.3 DOWNGRADE A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unaut
- CVE-2025-25747 MEDIUM 5.4 DOWNGRADE Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary
- CVE-2023-43378 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scri
FAQ
How do I fix digitaldruid vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is digitaldruid being exploited right now?
None of the tracked digitaldruid CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which digitaldruid CVE should I patch first?
CVE-2025-44203 currently ranks highest (43/100): In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before se.