CVE-2025-25749 Weak cryptography in n/a

What is CVE-2025-25749?

CVE-2025-25749 is a high-severity vulnerability in n/a, published on 11 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

Weakness: CWE-521

Which versions are affected by CVE-2025-25749?

It affects 1 product.

Products include Digitaldruid Hoteldruid.

How do I fix CVE-2025-25749?

No fix has been published for CVE-2025-25749 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-25749 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25749 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-43371 SQL injection in n/a Critical 9.8
• CVE-2023-43373 SQL injection in n/a Critical 9.8
• CVE-2023-43374 SQL injection in n/a Critical 9.8
• CVE-2023-43375 SQL injection in n/a Critical 9.8
• CVE-2021-42949 Auth bypass in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-25749, GHSA-2q6p-3x6p-8mcf, UBUNTU-CVE-2025-25749.