CVE-2021-42948

3.7 lowEPSS 0.8%

Low (3.7) in digitaldruid hoteldruid. EPSS 0.8% chance of exploitation in the next 30 days.

HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-319
Published: 2022-09-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

digitaldruid:hoteldruid

References

https://github.com/dhammon/HotelDruid-CVE-2021-42948
https://github.com/dhammon/Security
https://www.hoteldruid.com/
https://github.com/dhammon/HotelDruid-CVE-2021-42948
https://github.com/dhammon/Security

Check your stack JSON