Back to CVE records
High 8.6Published Jul 31, 2026
CVE-2025-67650Authenticated SQL Injection in PHP Jabbers scripts
Updated under an hour ago ()
Does this affect you?
It affects PHP Jabbers Appointment Scheduler and 34 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.
- CVSS
- 8.6 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-89
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CERT-PL
- NVD analysis
- Deferred
- Record last updated
- Jul 31, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
PHP Jabbers Appointment Scheduler php_jabbers:appointment_scheduler (from the name) | before 4.1 | CNA record |
PHP Jabbers Bus Reservation System php_jabbers:bus_reservation_system (from the name) | before 2.1 | CNA record |
PHP Jabbers Car Park Booking System php_jabbers:car_park_booking_system (from the name) | before 4.1 | CNA record |
PHP Jabbers Car Rental Script php_jabbers:car_rental_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Cinema Booking System php_jabbers:cinema_booking_system (from the name) | before 2.1 | CNA record |
PHP Jabbers Event Booking Calendar php_jabbers:event_booking_calendar (from the name) | before 5.1 | CNA record |
PHP Jabbers Event Ticketing System php_jabbers:event_ticketing_system (from the name) | before 2.1 | CNA record |
PHP Jabbers Hotel Booking System php_jabbers:hotel_booking_system (from the name) | before 5.1 | CNA record |
PHP Jabbers Cleaning Business Software php_jabbers:cleaning_business_software (from the name) | before 2.1 | CNA record |
PHP Jabbers Equipment Rental Script php_jabbers:equipment_rental_script (from the name) | before 2.1 | CNA record |
PHP Jabbers Food Delivery Script php_jabbers:food_delivery_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Member Login Script php_jabbers:member_login_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Member Directory Script php_jabbers:member_directory_script (from the name) | before 2.1 | CNA record |
PHP Jabbers Availability Calendar php_jabbers:availability_calendar (from the name) | before 6.1 | CNA record |
PHP Jabbers PHP Event Calendar php_jabbers:php_event_calendar (from the name) | before 4.1 | CNA record |
PHP Jabbers PHP Newsletter Script php_jabbers:php_newsletter_script (from the name) | before 5.1 | CNA record |
PHP Jabbers Product Comparison Script php_jabbers:product_comparison_script (from the name) | before 2.1 | CNA record |
PHP Jabbers Ticket Support Script php_jabbers:ticket_support_script (from the name) | before 4.1 | CNA record |
PHP Jabbers PHP Shopping Cart php_jabbers:php_shopping_cart (from the name) | before 6.0 | CNA record |
PHP Jabbers Auto Classifieds Script php_jabbers:auto_classifieds_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Business Directory Script php_jabbers:business_directory_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Availability Booking Calendar php_jabbers:availability_booking_calendar (from the name) | before 6.1 | CNA record |
PHP Jabbers Time Slots Booking Calendar php_jabbers:time_slots_booking_calendar (from the name) | before 5.1 | CNA record |
PHP Jabbers Restaurant Booking System php_jabbers:restaurant_booking_system (from the name) | before 4.1 | CNA record |
PHP Jabbers Shuttle Booking Software php_jabbers:shuttle_booking_software (from the name) | before 3.1 | CNA record |
PHP Jabbers Meeting Room Booking System php_jabbers:meeting_room_booking_system (from the name) | before 2.1 | CNA record |
PHP Jabbers Rental Property Booking Calendar php_jabbers:rental_property_booking_calendar (from the name) | before 3.1 | CNA record |
PHP Jabbers Service Booking Script php_jabbers:service_booking_script (from the name) | before 2.1 | CNA record |
PHP Jabbers Limo Booking Software php_jabbers:limo_booking_software (from the name) | before 2.1 | CNA record |
PHP Jabbers Taxi Booking Script php_jabbers:taxi_booking_script (from the name) | before 3.1 | CNA record |
PHP Jabbers Job Listing Script php_jabbers:job_listing_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Property Listing Script php_jabbers:property_listing_script (from the name) | before 4.1 | CNA record |
PHP Jabbers Travel Tours Script php_jabbers:travel_tours_script (from the name) | before 3.1 | CNA record |
PHP Jabbers Vacation Rental Script php_jabbers:vacation_rental_script (from the name) | before 5.1 | CNA record |
PHP Jabbers Yacht Listing Script php_jabbers:yacht_listing_script (from the name) | before 3.1 | CNA record |
References
- https://cert.pl/en/posts/2026/07/CVE-2025-67649/third-party-advisory
- https://www.phpjabbers.com/product
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.