Digitaldruid vulnerabilities
We track 4 vulnerabilities in Digitaldruid products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 20, 2025.
Latest Digitaldruid vulnerabilities
- 7.5 High severity
Hoteldruid: Generation of Error Message Containing Sensitive Information
In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during
- 7.3 High severity
Hoteldruid: Cross-Site Request Forgery
A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the abse
- 9.8 Critical severity
Hoteldruid: Improper Neutralization of Special Elements used in an SQL Command
Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscaddoc, giornonascita, giornoscaddoc, lingua_cli, mesenascita, and mesescaddoc parameters.
- 8.8 High severity
Hoteldruid: Improper Control of Generation of Code
HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.