CVE-2023-29839

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29848.8Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.CVE-2023-298428.8ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.CVE-2023-298475.4AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_conte CVE-2023-298484.8Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php CVE-2023-298498.8Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, o CVE-2023-29855.5A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause CVE-2023-298507.5SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain infor CVE-2023-298546.1DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.CVE-2023-298557.2WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.CVE-2023-298569.8D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.CVE-2023-298575.3An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.CVE-2023-29869.8The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2