CSRF in PHP Jabbers scripts
Summary
| CVE | CVE-2025-67651 |
|---|---|
| State | PUBLISHED |
| Assigner | CERT-PL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-31 12:16:48 UTC |
| Updated | 2026-08-28 15:26:19 UTC |
| Description | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list. |
Risk And Classification
Primary CVSS: v4.0 6.9 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001660000 probability, percentile 0.061510000 (date 2026-08-30)
Problem Types: CWE-352 | CWE-352 CWE-352 Cross-Site Request Forgery (CSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.9 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
ActiveConfidentiality
NoneIntegrity
HighAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | PHP Jabbers | Appointment Scheduler | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Bus Reservation System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Car Park Booking System | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Car Rental Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Cinema Booking System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Event Booking Calendar | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Event Ticketing System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Hotel Booking System | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Cleaning Business Software | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Equipment Rental Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Food Delivery Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Member Login Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Member Directory Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Availability Calendar | affected 6.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Event Calendar | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Newsletter Script | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Product Comparison Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Ticket Support Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Shopping Cart | affected 6.0 custom | Not specified |
| CNA | PHP Jabbers | Auto Classifieds Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Business Directory Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Availability Booking Calendar | affected 6.1 custom | Not specified |
| CNA | PHP Jabbers | Time Slots Booking Calendar | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Restaurant Booking System | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Shuttle Booking Software | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Meeting Room Booking System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Rental Property Booking Calendar | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Service Booking Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Limo Booking Software | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Taxi Booking Script | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Job Listing Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Property Listing Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Travel Tours Script | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Vacation Rental Script | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Yacht Listing Script | affected 3.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.phpjabbers.com | [email protected] | www.phpjabbers.com | |
| cert.pl/en/posts/2026/07/CVE-2025-67649 | [email protected] | cert.pl | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Kamil Szczurowski (en)
CNA: Robert Kruczek (en)
There are currently no legacy QID mappings associated with this CVE.