CVE-2025-67650

published 2026-07-31

CVE-2025-67650: An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated…

Priority P3 48 high 8.6 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI H VA L SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks.
This issue was fixed in the versions specified in the affected products list.

Affected

35 ranges · showing 25

Vendor	Product	Version range	Fixed in
php_jabbers	appointment_scheduler	< 4.1	4.1
php_jabbers	auto_classifieds_script	< 4.1	4.1
php_jabbers	availability_booking_calendar	< 6.1	6.1
php_jabbers	availability_calendar	< 6.1	6.1
php_jabbers	bus_reservation_system	< 2.1	2.1
php_jabbers	business_directory_script	< 4.1	4.1
php_jabbers	car_park_booking_system	< 4.1	4.1
php_jabbers	car_rental_script	< 4.1	4.1
php_jabbers	cinema_booking_system	< 2.1	2.1
php_jabbers	cleaning_business_software	< 2.1	2.1
php_jabbers	equipment_rental_script	< 2.1	2.1
php_jabbers	event_booking_calendar	< 5.1	5.1
php_jabbers	event_ticketing_system	< 2.1	2.1
php_jabbers	food_delivery_script	< 4.1	4.1
php_jabbers	hotel_booking_system	< 5.1	5.1
php_jabbers	job_listing_script	< 4.1	4.1
php_jabbers	limo_booking_software	< 2.1	2.1
php_jabbers	meeting_room_booking_system	< 2.1	2.1
php_jabbers	member_directory_script	< 2.1	2.1
php_jabbers	member_login_script	< 4.1	4.1
php_jabbers	php_event_calendar	< 4.1	4.1
php_jabbers	php_newsletter_script	< 5.1	5.1
php_jabbers	php_shopping_cart	< 6.0	6.0
php_jabbers	product_comparison_script	< 2.1	2.1
php_jabbers	property_listing_script	< 4.1	4.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89