CVE-2025-25749

HIGH

HotelDruid <3.0.7 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-25749. PoCs published by huyvo2910.

AI-analyzed exploit summary This repository documents CVE-2025-25749, a weak password policy vulnerability in HotelDruid 3.0.7, allowing users to set weak passwords without enforcement of complexity, history, or age restrictions. The PoC includes test cases demonstrating the acceptance of weak passwords and lack of security controls.

Description

An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

Exploits (1)

nomisec WRITEUP
by huyvo2910 · poc
https://github.com/huyvo2910/CVE-2025-25749-Weak-Password-Policy-in-HotelDruid-3.0.7

This repository documents CVE-2025-25749, a weak password policy vulnerability in HotelDruid 3.0.7, allowing users to set weak passwords without enforcement of complexity, history, or age restrictions. The PoC includes test cases demonstrating the acceptance of weak passwords and lack of security controls.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: HotelDruid 3.0.7 and earlier
No auth needed
Prerequisites: Access to HotelDruid password change functionality
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.1
EPSS 0.0056
EPSS Percentile 42.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-521
Status published
Products (1)
digitaldruid/hoteldruid < 3.0.7
Published Mar 11, 2025
Tracked Since Feb 18, 2026