CVE-2019-9581

Booked Scheduler 2.7.5 (phpscheduleit) is vulnerable to arbitrary file upload via the Favicon field. The root cause is that Presenters/Admin/ManageThemePresenter.php does not constrain image file extensions, allowing uploaded content to be executed as PHP code (Web/custom-favicon.php) on the serv...

CVE-2022-30706

The CVE-2022-30706 issue affects Booked versions prior to 3.3. Open redirect is possible when a specially crafted URL is accessed, enabling a remote unauthenticated attacker to redirect a user to an arbitrary site and potentially facilitate phishing. The root cause involves how user-supplied data...

CVE-2023-24058

The CVE-2023-24058 entry concerns Booked Scheduler 2.5.5 (2014) where an authenticated user can schedule events for another user by modifying the userId in reservation_save.php. The LabArchives Scheduler (2022 feature release) is also affected per linked references. The latest Booked Scheduler ve...