The Hotel Management System Project maintains a focused web-based property-management platform that, despite a narrow product scope, operates in a sector where data breaches expose guest information and financial records, making it a high-value target. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and concentrate on input-handling weaknesses endemic to web applications: SQL injection and cross-site scripting flaws that allow direct database manipulation and client-side compromise. Defenders deploying this system should prioritize input validation and output encoding controls, and track patches closely for the inherent web-tier attack surface; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hotel Management System Project over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-28110CRITICAL Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the login page. | May 10, 2022 | 9.8 | 30 | NO | NO |
CVE-2024-25315CRITICAL Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2. | Feb 9, 2024 | 9.8 | 26 | NO | NO |
CVE-2024-25318HIGH Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2. | Feb 9, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-25316CRITICAL Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2. | Feb 9, 2024 | 9.8 | 24 | NO | NO |
CVE-2024-25314CRITICAL Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2. | Feb 9, 2024 | 9.8 | 24 | NO | NO |
CVE-2021-41651HIGH A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the | Oct 4, 2021 | 7.5 | 24 | NO | NO |
CVE-2022-48090MEDIUM Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php. | Jan 13, 2023 | 6.5 | 22 | NO | NO |
CVE-2022-27475MEDIUM Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded. | Apr 13, 2022 | 6.1 | 22 | NO | NO |
CVE-2022-2291MEDIUM A vulnerability was found in SourceCodester Hotel Management System 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /ci_hms/search of | Jul 12, 2022 | 5.4 | 21 | NO | NO |
CVE-2022-36254MEDIUM Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML v | Sep 12, 2022 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hotel Management System Project.
Media articles that mention a CVE ID that affects a product developed by Hotel Management System Project — matched by CVE ID, not by vendor name.