Twinkletoessoftware

Booked

3 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2023-24058

Exploit
  • EPSS 0.16%
  • Veröffentlicht 22.01.2023 06:15:10
  • Zuletzt bearbeitet 02.04.2025 17:15:36

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. Howeve...

6.1

CVE-2022-30706

  • EPSS 0.28%
  • Veröffentlicht 26.07.2022 06:15:07
  • Zuletzt bearbeitet 21.11.2024 07:03:13

Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

8.8

CVE-2019-9581

Exploit
  • EPSS 17.92%
  • Veröffentlicht 06.03.2019 00:29:01
  • Zuletzt bearbeitet 21.11.2024 04:51:53

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.