cert.plThird-party advisory
https://cert.pl/en/posts/2026/07/CVE-2025-67649 CVE-2025-67650
HIGH
Authenticated SQL Injection in PHP Jabbers scripts
Record summary
CVE-2025-67650 has a selected CVSS score of 8.6 (high).
Description
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 35| Product | Source | Version range | Status |
|---|---|---|---|
Appointment SchedulerBrowse PHP Jabbers / Appointment SchedulerDefault status: unaffected | CVE List | Before 4.1 | affected |
Auto Classifieds ScriptBrowse PHP Jabbers / Auto Classifieds ScriptDefault status: unaffected | CVE List | Before 4.1 | affected |
Availability Booking CalendarBrowse PHP Jabbers / Availability Booking CalendarDefault status: unaffected | CVE List | Before 6.1 | affected |
Availability CalendarBrowse PHP Jabbers / Availability CalendarDefault status: unaffected | CVE List | Before 6.1 | affected |
Bus Reservation SystemBrowse PHP Jabbers / Bus Reservation SystemDefault status: unaffected | CVE List | Before 2.1 | affected |
Business Directory ScriptBrowse PHP Jabbers / Business Directory ScriptDefault status: unaffected | CVE List | Before 4.1 | affected |
Car Park Booking SystemBrowse PHP Jabbers / Car Park Booking SystemDefault status: unaffected | CVE List | Before 4.1 | affected |
Car Rental ScriptBrowse PHP Jabbers / Car Rental ScriptDefault status: unaffected | CVE List | Before 4.1 | affected |
Cinema Booking SystemBrowse PHP Jabbers / Cinema Booking SystemDefault status: unaffected | CVE List | Before 2.1 | affected |
Cleaning Business SoftwareBrowse PHP Jabbers / Cleaning Business SoftwareDefault status: unaffected | CVE List | Before 2.1 | affected |
Equipment Rental ScriptBrowse PHP Jabbers / Equipment Rental ScriptDefault status: unaffected | CVE List | Before 2.1 | affected |
Event Booking CalendarBrowse PHP Jabbers / Event Booking CalendarDefault status: unaffected | CVE List | Before 5.1 | affected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-67650 phpjabbers.comproduct
https://www.phpjabbers.com/