CVE-2023-34537
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A Reflected XSS vulnerability was discovered in HotelDruid version 3.0.5, allowing an attacker to inject malicious code into webpage parameters, potentially tricking users in their browsers or exfiltrating data.
Risk Assessment
This vulnerability could lead to user data theft and deception, posing a security risk to the organization.
Recommendation
It is recommended to update to the latest version of HotelDruid and implement appropriate security measures against XSS attacks.
Other vulnerabilities in HotelDruid 3.0.5
See all- CVE-2023-34854Medium
HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. This may allow uploading dangerous files.
- CVE-2025-44203High
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup completion, causing a race condition during database creation. Sending many concurrent requests can disclose the administrator username, password hash, and salt, and leave the setup partially initialized, preventing login and requiring reinstallation.
- CVE-2023-33817High
Version 3.0.5 of hoteldruid was found to contain a SQL injection vulnerability.
Original NVD description (English source)
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS