Vulnerabilities
5 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33948 | SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. NVD description · AI analysis pending | 9.8 | <1% | PoC |
| — | |
| CVE-2020-18102 | Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the componen Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php". NVD description · AI analysis pending | 6.1 | 1% | PoC |
| — | |
| CVE-2019-8393 | Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2019-7648 | controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage. controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage. NVD description · AI analysis pending | 7.5 | <1% | PoC |
| — | |
| CVE-2019-6497 | Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter. Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — |