CVE-2025-67650

Authenticated SQL Injection in PHP Jabbers scripts

State: Published
Severity: 8.6 High
Published: Jul 31, 2026
Updated: Jul 31, 2026
Reserved: Dec 9, 2025

Description

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Affected Products

Product	Versions
Appointment SchedulerPHP Jabbers	before 4.1Affected
Bus Reservation SystemPHP Jabbers	before 2.1Affected
Car Park Booking SystemPHP Jabbers	before 4.1Affected
Car Rental ScriptPHP Jabbers	before 4.1Affected
Cinema Booking SystemPHP Jabbers	before 2.1Affected
Event Booking CalendarPHP Jabbers	before 5.1Affected
Event Ticketing SystemPHP Jabbers	before 2.1Affected
Hotel Booking SystemPHP Jabbers	before 5.1Affected
Cleaning Business SoftwarePHP Jabbers	before 2.1Affected
Equipment Rental ScriptPHP Jabbers	before 2.1Affected
Food Delivery ScriptPHP Jabbers	before 4.1Affected
Member Login ScriptPHP Jabbers	before 4.1Affected
Member Directory ScriptPHP Jabbers	before 2.1Affected
Availability CalendarPHP Jabbers	before 6.1Affected
PHP Event CalendarPHP Jabbers	before 4.1Affected
PHP Newsletter ScriptPHP Jabbers	before 5.1Affected
Product Comparison ScriptPHP Jabbers	before 2.1Affected
Ticket Support ScriptPHP Jabbers	before 4.1Affected
PHP Shopping CartPHP Jabbers	before 6.0Affected
Auto Classifieds ScriptPHP Jabbers	before 4.1Affected
Business Directory ScriptPHP Jabbers	before 4.1Affected
Availability Booking CalendarPHP Jabbers	before 6.1Affected
Time Slots Booking CalendarPHP Jabbers	before 5.1Affected
Restaurant Booking SystemPHP Jabbers	before 4.1Affected
Shuttle Booking SoftwarePHP Jabbers	before 3.1Affected
Meeting Room Booking SystemPHP Jabbers	before 2.1Affected
Rental Property Booking CalendarPHP Jabbers	before 3.1Affected
Service Booking ScriptPHP Jabbers	before 2.1Affected
Limo Booking SoftwarePHP Jabbers	before 2.1Affected
Taxi Booking ScriptPHP Jabbers	before 3.1Affected
Job Listing ScriptPHP Jabbers	before 4.1Affected
Property Listing ScriptPHP Jabbers	before 4.1Affected
Travel Tours ScriptPHP Jabbers	before 3.1Affected
Vacation Rental ScriptPHP Jabbers	before 5.1Affected
Yacht Listing ScriptPHP Jabbers	before 3.1Affected

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/third-party-advisory
https://www.phpjabbers.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.