CozyStay vulnerabilities

3 known vulnerabilities in CozyStay from LoftOcean. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  CozyStay: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-67988Feb 20, 2026LoftOcean

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1.

• 8.1 High severity

  CozyStay: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-49508Jun 17, 2025LoftOcean

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.

• 9.8 Critical severity

  CozyStay: Deserialization of Untrusted Data

  CVE-2025-49507Jun 10, 2025LoftOcean

  Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.