Hospitality Opera 5 Property Services

CVE-2026-71106 Aug 18, 21:18 HIGH This Week

Remote unauthenticated takeover of Oracle Hospitality OPERA 5 Property Services (Opera Servlet component) is possible in versions 5.6.28.0 through 5.6.28.1 via HTTP, with an attacker requiring no privileges and only low attack complexity. The UI:R CVSS metric indicates exploitation depends on human interaction from a non-attacker party, consistent with client-side injection or CSRF-style attack patterns targeting hotel staff sessions. Full compromise of confidentiality, integrity, and availability is confirmed as the impact; no public exploit has been identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

CVE-2023-22087 Oct 17, 22:15 HIGH PATCH This Week

Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.

CVE-2023-22085 Oct 17, 22:15 HIGH PATCH This Week

Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-21932 Apr 18, 20:15 HIGH This Week

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2020-14877 Oct 21, 15:15 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Logging). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2020-14858 Oct 21, 15:15 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Logging). Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2019-10219 Nov 08, 15:15 Maven MEDIUM POC PATCH This Month

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-10197 Oct 19, 17:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: Folios). Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2017-10182 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Export Functionality). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.

CVE-2017-3574 Apr 24, 19:59 HIGH This Week

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA License code configuration). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2017-3573 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Printing). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2017-3569 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Business Events). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2017-3568 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Printing and Login). Rated medium severity (CVSS 6.5), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-3560 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OXI Interface). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2017-3552 Apr 24, 19:59 MEDIUM This Month

Vulnerability in the Oracle Hospitality OPERA 5 Property Services component of Oracle Hospitality Applications (subcomponent: OPERA Room Image/Picture Setup). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2016-5565 Oct 25, 14:30 HIGH PATCH This Week

Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2016-5564 Oct 25, 14:30 HIGH PATCH This Week

Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2016-5563 Oct 25, 14:30 HIGH PATCH This Week

Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote administrators. Rated high severity (CVSS 7.9), this vulnerability is remotely exploitable.