Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: HotelRunner Clear all filters
TI-2025-03825 CVE-2025-4296 · GHSA-5cq4-pp95-gvqj

Open Redirect in HotelRunner's B2B

Priority LOW 21

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00227 Published 2025-07-23 Fixed in 04.06.2025 CWE-601
TI-2025-03824 CVE-2025-4295 · GHSA-wwh7-vxvp-9vmx

Host Header Injection in HotelRunner's B2B

Priority LOW 20

Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00118 Published 2025-07-22 Fixed in 04.06.2025 CWE-297
TI-2025-03823 CVE-2025-4294 · GHSA-gphf-mppm-mv89

XSS in HotelRunner's B2B

Priority LOW 21

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00208 Published 2025-07-22 Fixed in 04.06.2025 CWE-79