CVE catalog

CVE-2025-25749

hoteldruid: CVE-2025-25749

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianhoteldruidsid3.0.8-1fixed
Debianhoteldruidbookworm3.0.4-1vulnerable
Ubuntuhoteldruid16.042.1.0-1vulnerable
Ubuntuhoteldruid16.042.1.3-1vulnerable
Ubuntuhoteldruid16.042.1.4-1vulnerable
Ubuntuhoteldruid16.042.1.4-1ubuntu1vulnerable
Ubuntuhoteldruid16.042.1.4-1ubuntu2vulnerable
Ubuntuhoteldruid18.042.2.1-1vulnerable
Ubuntuhoteldruid18.042.2.2-1vulnerable
Ubuntuhoteldruid20.042.3.2-1vulnerable
Ubuntuhoteldruid20.043.0.0-1vulnerable
Ubuntuhoteldruid20.043.0.1-1vulnerable
Ubuntuhoteldruid22.043.0.1-1vulnerable
Ubuntuhoteldruid22.043.0.3-1vulnerable
Ubuntuhoteldruid24.043.0.5-1vulnerable
Ubuntuhoteldruid24.043.0.6-1vulnerable
Ubuntuhoteldruid25.103.0.6-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianhoteldruidsourcesid3.0.8-1not yet assignedNot reported[1101015]
Debianhoteldruidsourcebookworm(unfixed)not yet assignedNot reported[1101015]

[Debian bug #1101015]

Notes

[bookworm] hoteldruid: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [hoteldruid]Affected
    Details (2)

    • 3.0.4-1 · all · bookworm

      Affected

      dsa · hoteldruid · debian · bookworm; dsa · hoteldruid · debian · 12

    • 3.0.4-1 · all · bookworm

      Affected

      dsa · hoteldruid · debian · bookworm; dsa · hoteldruid · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]