Security Advisory
CVE-2020-37077
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable tn parameter to read files outside the intended directory by manipulating directory path traversal techniques.