---
id: CVE-2025-55816
title: >-
  HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in
  the /modifica_app.php file.
summary: >-
  HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in
  the /modifica_app.php file.
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: digitaldruid
product: hoteldruid
affected:
  - hoteldruid <= 3.0.7
published: '2025-12-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-55816'
references:
  - url: 'https://www.hoteldruid.com/en/'
    label: cve@mitre.org
  - url: 'https://www.partywave.site/show/research/cve-2025-55816-xss-and-raptx'
    label: cve@mitre.org
tags:
  - nvd
  - exploit-available
epss: 0.00274
epssPercentile: 0.18451
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/partywavesec/CVE-2025-55816'
  checkedAt: '2026-10-14T20:53:46.788Z'
exploitAvailable: true
ingestedAt: '2026-10-14T20:53:12.285Z'
---

## Overview

HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

## Affected

- `hoteldruid <= 3.0.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.