CVE-2020-37077
Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable 'tn' parameter to read files outside the intended directory by manipulating directory path traversal techniques.
- Score
- CVSS 4.0 6.9 Medium
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-02-03
- Last modified
- 2026-02-04
- Weaknesses
- CWE-22
Affected products
References
- https://web.archive.org/web/20190612055926/https://sourceforge.net/projects/phpscheduleit/
- https://www.bookedscheduler.com
- https://www.exploit-db.com/exploits/48428
- https://www.vulncheck.com/advisories/booked-scheduler-authenticated-directory-traversal
