CVE-2025-67651

published 2026-07-31

CVE-2025-67651: A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite…

Priority P4 33 medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI A VC N VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.

This issue was fixed in the versions specified in the affected products list.

Affected

35 ranges · showing 25

Vendor	Product	Version range	Fixed in
php_jabbers	appointment_scheduler	< 4.1	4.1
php_jabbers	auto_classifieds_script	< 4.1	4.1
php_jabbers	availability_booking_calendar	< 6.1	6.1
php_jabbers	availability_calendar	< 6.1	6.1
php_jabbers	bus_reservation_system	< 2.1	2.1
php_jabbers	business_directory_script	< 4.1	4.1
php_jabbers	car_park_booking_system	< 4.1	4.1
php_jabbers	car_rental_script	< 4.1	4.1
php_jabbers	cinema_booking_system	< 2.1	2.1
php_jabbers	cleaning_business_software	< 2.1	2.1
php_jabbers	equipment_rental_script	< 2.1	2.1
php_jabbers	event_booking_calendar	< 5.1	5.1
php_jabbers	event_ticketing_system	< 2.1	2.1
php_jabbers	food_delivery_script	< 4.1	4.1
php_jabbers	hotel_booking_system	< 5.1	5.1
php_jabbers	job_listing_script	< 4.1	4.1
php_jabbers	limo_booking_software	< 2.1	2.1
php_jabbers	meeting_room_booking_system	< 2.1	2.1
php_jabbers	member_directory_script	< 2.1	2.1
php_jabbers	member_login_script	< 4.1	4.1
php_jabbers	php_event_calendar	< 4.1	4.1
php_jabbers	php_newsletter_script	< 5.1	5.1
php_jabbers	php_shopping_cart	< 6.0	6.0
php_jabbers	product_comparison_script	< 2.1	2.1
php_jabbers	property_listing_script	< 4.1	4.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352