CVE Feed

    Dashboard / CVE / CVE-2023-34537

    CVE-2023-34537

    A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.

    Published:Jun 13, 2023
    Last Modified:Jan 3, 2025
    EPS:Jun 13, 2023
    EPSS Score:0.12787
    CVSS Score:5.4

    Affected Products

    Vendor
    Digitaldruid
    Product
    Hoteldruid

    Exploits

    https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5https://github.com/leekenghwa/CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5

    Related CVEs

    CVE-2025-55816 (CVSS 6.1) — HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.…
    CVE-2025-44203 (CVSS 7.5) — In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before se…
    CVE-2023-43378 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scri…
    CVE-2025-25749 (CVSS 7.1) — An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforce…
    CVE-2025-25748 (CVSS 7.3) — A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unaut…
    CVE-2025-25747 (CVSS 5.4) — Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary …
    CVE-2024-23091 (CVSS 7.5) — Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plainte…
    CVE-2023-47164 (CVSS 6.1) — Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to…
    CVE-2023-43375 (CVSS 9.8) — Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php …
    CVE-2023-43373 (CVSS 9.8) — Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /h…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High