HOMEVULNERABILITIESVENDORSHotels Server Project

Hotels Server ProjectCVEs & Vulnerabilities

5 CVEs affecting Hotels Server Project products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

5 CVEs→ All vendors

Most Affected Products

hotels server 5
CVE-2021-33948CRITICAL

SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter.

17 Feb 2023
9.8
CVSS
CVE-2020-18102MEDIUM

Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".

10 May 2021
6.1
CVSS
CVE-2019-8393CRITICAL

Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.

17 Feb 2019
9.8
CVSS
CVE-2019-7648HIGH

controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage.

8 Feb 2019
7.5
CVSS
CVE-2019-6497CRITICAL

Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.

20 Jan 2019
9.8
CVSS
← PrevPage 1 / 1Next →
← All Vendors·CVE Database