CVE-2019-9581

phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.

• CWE-434

• http://packetstormsecurity.com/files/165263/Booked-Scheduler-2.7.5-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://pentest.com.tr/exploits/Booked-2-7-5-Remote-Command-Execution-Metasploit.htmlExploit, Patch, Third Party Advisory
• https://sourceforge.net/p/phpscheduleit/source/ci/c5a86a279d888bd4362e4b4f61acedc054f99c39/Patch
• https://www.exploit-db.com/exploits/46486Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165263/Booked-Scheduler-2.7.5-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://pentest.com.tr/exploits/Booked-2-7-5-Remote-Command-Execution-Metasploit.htmlExploit, Patch, Third Party Advisory
• https://sourceforge.net/p/phpscheduleit/source/ci/c5a86a279d888bd4362e4b4f61acedc054f99c39/Patch
• https://www.exploit-db.com/exploits/46486Exploit, Third Party Advisory, VDB Entry

Published

Mar 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9574The WP Human Resource Management plugin before 2.2.6 for Wor…
• CVE-2019-9575The Quiz And Survey Master plugin 6.0.4 for WordPress allows…
• CVE-2019-9576The Blog2Social plugin before 5.0.3 for WordPress allows wp-…
• CVE-2019-9578In devs.c in Yubico libu2f-host before 1.1.8, the response t…
• CVE-2019-9579An issue was discovered in Illumos in Nexenta NexentaStor 4.…8.1
• CVE-2019-9580In st2web in StackStorm Web UI before 2.9.3 and 2.10.x befor…
• CVE-2019-9582eQ-3 Homematic CCU2 outdated base software packages allows D…
• CVE-2019-9583eQ-3 Homematic CCU2 and CCU3 obtain session IDs without logi…8.2
• CVE-2019-9584eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows un…
• CVE-2019-9585eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.…
• CVE-2019-9587There is a stack consumption issue in md5Round1() located in…
• CVE-2019-9588There is an Invalid memory access in gAtomicIncrement() loca…