Twinkletoessoftware

Booked

4 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2020-37077

  • EPSS 0.11%
  • Veröffentlicht 03.02.2026 22:16:23
  • Zuletzt bearbeitet 04.02.2026 16:33:44

Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable 'tn' parameter to read files outs...

4.3

CVE-2023-24058

Exploit
  • EPSS 0.48%
  • Veröffentlicht 22.01.2023 06:15:10
  • Zuletzt bearbeitet 02.04.2025 17:15:36

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. Howeve...

6.1

CVE-2022-30706

  • EPSS 0.28%
  • Veröffentlicht 26.07.2022 06:15:07
  • Zuletzt bearbeitet 21.11.2024 07:03:13

Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

8.8

CVE-2019-9581

Exploit
  • EPSS 17.12%
  • Veröffentlicht 06.03.2019 00:29:01
  • Zuletzt bearbeitet 21.11.2024 04:51:53

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.