First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-25749

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.huyvo.net/post/cve-2025-25749-weak-password-policy-in-hoteldruid-3-0-7Exploit, Mitigation, Third Party Advisory

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-25755.4The Z Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including,CVE-2025-257587.5An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANd CVE-2025-257597.5An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via CVE-2025-25766.4The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all version CVE-2025-257607.5A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and service CVE-2025-257617.2HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.CVE-2025-257639.8crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php CVE-2025-257654.0MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.CVE-2025-257664.8An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via upl CVE-2025-257674.8A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrari CVE-2025-257685.4MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.jav CVE-2025-257698.0Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.

CVE-2025-25749: High severity, CVSS 7.1 | Vulnix