PHP Jabbers Vulnerabilities and Affected Products
Vulnerabilities associated with Availability Booking Calendar.
Products
Clear product- Availability Booking Calendar3 vulnerabilities
- Bus Reservation System3 vulnerabilities
- Car Rental Script3 vulnerabilities
- Service Booking Script3 vulnerabilities
- Shuttle Booking Software3 vulnerabilities
- Appointment Scheduler2 vulnerabilities
- Auto Classifieds Script2 vulnerabilities
- Availability Calendar2 vulnerabilities
- Business Directory Script2 vulnerabilities
- Car Park Booking System2 vulnerabilities
- Cinema Booking System2 vulnerabilities
- Cleaning Business Software2 vulnerabilities
- Equipment Rental Script2 vulnerabilities
- Event Booking Calendar2 vulnerabilities
- Event Ticketing System2 vulnerabilities
- Food Delivery Script2 vulnerabilities
- Hotel Booking System2 vulnerabilities
- Job Listing Script2 vulnerabilities
- Limo Booking Software2 vulnerabilities
- Meeting Room Booking System2 vulnerabilities
- Member Directory Script2 vulnerabilities
- Member Login Script2 vulnerabilities
- PHP Event Calendar2 vulnerabilities
- PHP Newsletter Script2 vulnerabilities
- PHP Poll Script2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-67651MEDIUM | CSRF in PHP Jabbers scriptsA Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list. CWE-352Jul 31, 2026 | CVSS6.9v4.0 | EPSS0.166% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-67650HIGH | Authenticated SQL Injection in PHP Jabbers scriptsAn authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list. CWE-89Jul 31, 2026 | CVSS8.6v4.0 | EPSS0.279% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
PHP Jabbers Availability Booking Calendar index.php cross site scriptingA vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument session_id leads to cross site scripting. The attack can be launched remotely. The identifier VDB-235957 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | CVSS3.5v3.1 | EPSS1.79% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |