HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 11, 2025 · NIST NVD

   Detected

   HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

2. Oct 14, 2026 · NIST NVD

   Updated

   HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

Affected

• cpe digitaldruid/hoteldruidversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-55816

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-55816

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2025-55816

  HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

  nvd.nist.gov

References

• Product · hoteldruid.com
• Exploit · partywave.site