Read the docs

HotelRunner

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

HotelRunner records in CISA KEV

No HotelRunner vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2025-03825 CVE-2025-4296 · GHSA-5cq4-pp95-gvqj

Open Redirect in HotelRunner's B2B

Priority LOW 21

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00227 Published 2025-07-23 Fixed in 04.06.2025 CWE-601
TI-2025-03823 CVE-2025-4294 · GHSA-gphf-mppm-mv89

XSS in HotelRunner's B2B

Priority LOW 21

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00208 Published 2025-07-22 Fixed in 04.06.2025 CWE-79
TI-2025-03824 CVE-2025-4295 · GHSA-wwh7-vxvp-9vmx

Host Header Injection in HotelRunner's B2B

Priority LOW 20

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00118 Published 2025-07-22 Fixed in 04.06.2025 CWE-297
Open these records in search →