Resortdata's vulnerability profile centers on its Internet Reservation Module Next Generation product, a web-facing booking and hospitality-management system where the durable signal reflects credential-handling and input-validation weaknesses including hard-coded credentials, injection flaws, SQL injection, and unsafe file-upload handling. These weakness classes are characteristic of internet-exposed applications that accept and process user-submitted data in database-backed environments. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Resortdata over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-39422CRITICAL The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded | Sep 7, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-39423CRITICAL The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions tabl | Sep 7, 2023 | 9.1 | 25 | NO | NO |
CVE-2023-39424HIGH A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to t | Sep 7, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-39420HIGH The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password compu | Sep 7, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-39421HIGH The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow | Sep 7, 2023 | 7.7 | 22 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Resortdata.
Media articles that mention a CVE ID that affects a product developed by Resortdata — matched by CVE ID, not by vendor name.