CVE-2019-9581: Twinkletoessoftware Booked

High severity, CVSS 8.8. EPSS: 13.5% chance of exploitation in the next 30 days.

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.

Affected products

• Twinkletoessoftware Booked: version 2.7.5 only

Published 2019-03-06. Last modified 2026-06-17.