Hotels Server Project maintains a single, focused server application where the observed vulnerability surface centers on application-layer input-handling weaknesses, including SQL injection, cross-site scripting, and inadequate encryption strength. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hotels Server Project over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-8393CRITICAL Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. | Feb 17, 2019 | 9.8 | 31 | NO | NO |
CVE-2021-33948CRITICAL SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter. | Feb 17, 2023 | 9.8 | 30 | NO | NO |
CVE-2019-6497CRITICAL Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter. | Jan 20, 2019 | 9.8 | 29 | NO | NO |
CVE-2020-18102MEDIUM Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publi | May 10, 2021 | 6.1 | 21 | NO | NO |
CVE-2019-7648HIGH controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage. | Feb 8, 2019 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hotels Server Project.
Media articles that mention a CVE ID that affects a product developed by Hotels Server Project — matched by CVE ID, not by vendor name.