Default credentials

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension...

PT-2019-19723

Name of the Vulnerable Software and Affected Versions phpscheduleit Booked Scheduler version 2.7.5 Description The issue allows for arbitrary file upload through the Favicon field. This can lead to the execution of arbitrary PHP code in Web/custom-favicon.php, because the ManageThemePresenter.php...

CVE-2019-9581: Unrestricted Upload of File with Dangerous Type

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension...