CVE-2022-26564 is a medium-severity cross-site scripting (XSS) vulnerability found in HotelDruid Hotel Management Software v3.0.3. An unauthenticated attacker can exploit this flaw by injecting malicious scripts into the 'prezzoperiodo4' parameter in 'creaprezzi.php', leading to client-side code execution and potential information disclosure or session hijacking. While the CVSS score is 6.1, its EPSS score is very low, suggesting a minimal likelihood of exploitation in the wild. There is no evidence of active exploitation, Metasploit modules, or ExploitDB entries, though a Nuclei template exists for detection. Community discussion and media coverage for this CVE are negligible.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.0.3CPE matchmatch criteria | cpe:2.3:a:digitaldruid:hoteldruid:3.0.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.