https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-44203.htmlhttps://patchthecve.com/cve/CVE-2025-44203.htmlThu, 09 Jul 2026 15:16:28 +0000HIGH 7.5: In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages discloshttps://patchthecve.com/cve/CVE-2023-43378.htmlhttps://patchthecve.com/cve/CVE-2023-43378.htmlWed, 17 Jun 2026 06:25:31 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter.https://patchthecve.com/cve/CVE-2025-25749.htmlhttps://patchthecve.com/cve/CVE-2025-25749.htmlWed, 17 Jun 2026 09:01:09 +0000HIGH 7.1: An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.https://patchthecve.com/cve/CVE-2025-25748.htmlhttps://patchthecve.com/cve/CVE-2025-25748.htmlWed, 17 Jun 2026 09:01:08 +0000HIGH 7.3: A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputhttps://patchthecve.com/cve/CVE-2025-25747.htmlhttps://patchthecve.com/cve/CVE-2025-25747.htmlWed, 17 Jun 2026 09:01:08 +0000MEDIUM 5.4: Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpointhttps://patchthecve.com/cve/CVE-2024-23091.htmlhttps://patchthecve.com/cve/CVE-2024-23091.htmlWed, 17 Jun 2026 07:12:01 +0000HIGH 7.5: Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.