A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function.
References
| Link | Resource |
|---|---|
| https://github.com/jichngan/CVE-2023-29839 | Exploit |
| https://github.com/jichngan/CVE-2023-29839 | Exploit |
Configurations
History
07 Apr 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:digitaldruid:hoteldruid:3.0.4:*:*:*:*:*:*:* | |
| First Time |
Digitaldruid hoteldruid
|
21 Nov 2024, 07:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jichngan/CVE-2023-29839 - Exploit |
09 May 2023, 17:08
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CWE | CWE-79 | |
| First Time |
Digitaldruid hotel Druid
Digitaldruid |
|
| CPE | cpe:2.3:a:digitaldruid:hotel_druid:3.0.4:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/jichngan/CVE-2023-29839 - Exploit |
03 May 2023, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-03 03:15
Updated : 2025-04-07 14:15
NVD link : CVE-2023-29839
Mitre link : CVE-2023-29839
CVE.ORG link : CVE-2023-29839
JSON object : View
Products Affected
digitaldruid
- hoteldruid
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')