CVE-2019-9581

PoC ×3—

CVSS 3.1

8.8 high

EPSS

13%p96

Published

Mar 6, 2019 (Mar 6, 2019)

Modified

Jun 17, 2026

Description

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.

Vendors: twinkletoessoftware
Products: booked
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (13.5%)

In the news0 stories

No ingested article mentions this CVE yet.