What’s Vulnerable › Vulnerabilities

CVE-2024-23091

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-07-30 · updated 2026-06-17
• Weakness: CWE-916

Description

Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.

Affected products

• DigitalDruid.Net HOTELDRUID: before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: DigitalDruid.Net HOTELDRUID 1.3.2. Check the vendor advisory for mitigations.

References

• https://medium.com/%40cnetsec/security-advisory-cve-2024-23091-weak-password-hashing-using-md5-f18a6fe3a473
• https://www.hoteldruid.com/en/download.html
• https://medium.com/%40cnetsec/security-advisory-cve-2024-23091-weak-password-hashing-using-md5-f18a6fe3a473
• https://www.hoteldruid.com/en/download.html

Get alerted when CVE-2024-23091 or the next vulnerability affects your stack