CVE-2025-67651

CSRF in PHP Jabbers scripts

State: Published
Severity: 6.9 Medium
Published: Jul 31, 2026
Updated: Jul 31, 2026
Reserved: Dec 9, 2025

Description

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.

This issue was fixed in the versions specified in the affected products list.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Appointment SchedulerPHP Jabbers	before 4.1Affected
Bus Reservation SystemPHP Jabbers	before 2.1Affected
Car Park Booking SystemPHP Jabbers	before 4.1Affected
Car Rental ScriptPHP Jabbers	before 4.1Affected
Cinema Booking SystemPHP Jabbers	before 2.1Affected
Event Booking CalendarPHP Jabbers	before 5.1Affected
Event Ticketing SystemPHP Jabbers	before 2.1Affected
Hotel Booking SystemPHP Jabbers	before 5.1Affected
Cleaning Business SoftwarePHP Jabbers	before 2.1Affected
Equipment Rental ScriptPHP Jabbers	before 2.1Affected
Food Delivery ScriptPHP Jabbers	before 4.1Affected
Member Login ScriptPHP Jabbers	before 4.1Affected
Member Directory ScriptPHP Jabbers	before 2.1Affected
Availability CalendarPHP Jabbers	before 6.1Affected
PHP Event CalendarPHP Jabbers	before 4.1Affected
PHP Newsletter ScriptPHP Jabbers	before 5.1Affected
Product Comparison ScriptPHP Jabbers	before 2.1Affected
Ticket Support ScriptPHP Jabbers	before 4.1Affected
PHP Shopping CartPHP Jabbers	before 6.0Affected
Auto Classifieds ScriptPHP Jabbers	before 4.1Affected
Business Directory ScriptPHP Jabbers	before 4.1Affected
Availability Booking CalendarPHP Jabbers	before 6.1Affected
Time Slots Booking CalendarPHP Jabbers	before 5.1Affected
Restaurant Booking SystemPHP Jabbers	before 4.1Affected
Shuttle Booking SoftwarePHP Jabbers	before 3.1Affected
Meeting Room Booking SystemPHP Jabbers	before 2.1Affected
Rental Property Booking CalendarPHP Jabbers	before 3.1Affected
Service Booking ScriptPHP Jabbers	before 2.1Affected
Limo Booking SoftwarePHP Jabbers	before 2.1Affected
Taxi Booking ScriptPHP Jabbers	before 3.1Affected
Job Listing ScriptPHP Jabbers	before 4.1Affected
Property Listing ScriptPHP Jabbers	before 4.1Affected
Travel Tours ScriptPHP Jabbers	before 3.1Affected
Vacation Rental ScriptPHP Jabbers	before 5.1Affected
Yacht Listing ScriptPHP Jabbers	before 3.1Affected

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/third-party-advisory
https://www.phpjabbers.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.