# Authenticated SQL Injection in PHP Jabbers scripts

CVE record · `CVE-2025-67650`

- **Identifiers:** `CVE-2025-67650`
- **State:** Confirmed
- **Severity:** CVSS 8.6 High
- **Critical:** No
- **CNA:** CERT-PL
- **Weakness (CWE):** [CWE-89](https://cwe.mitre.org/data/definitions/89.html)
- **Tags:** [SQL injection](https://agentprime.io/advisories/tag/sql-injection.md)
- **Technologies:** [PHP Jabbers Appointment Scheduler](https://agentprime.io/advisories/technology/php-jabbers-appointment-scheduler.md) · [PHP Jabbers Bus Reservation System](https://agentprime.io/advisories/technology/php-jabbers-bus-reservation-system.md) · [PHP Jabbers Car Park Booking System](https://agentprime.io/advisories/technology/php-jabbers-car-park-booking-system.md) · [PHP Jabbers Car Rental Script](https://agentprime.io/advisories/technology/php-jabbers-car-rental-script.md) · [PHP Jabbers Cinema Booking System](https://agentprime.io/advisories/technology/php-jabbers-cinema-booking-system.md) · [PHP Jabbers Event Booking Calendar](https://agentprime.io/advisories/technology/php-jabbers-event-booking-calendar.md) · [PHP Jabbers Event Ticketing System](https://agentprime.io/advisories/technology/php-jabbers-event-ticketing-system.md) · [PHP Jabbers Hotel Booking System](https://agentprime.io/advisories/technology/php-jabbers-hotel-booking-system.md) · [PHP Jabbers Cleaning Business Software](https://agentprime.io/advisories/technology/php-jabbers-cleaning-business-software.md) · [PHP Jabbers Equipment Rental Script](https://agentprime.io/advisories/technology/php-jabbers-equipment-rental-script.md) · [PHP Jabbers Food Delivery Script](https://agentprime.io/advisories/technology/php-jabbers-food-delivery-script.md) · [PHP Jabbers Member Login Script](https://agentprime.io/advisories/technology/php-jabbers-member-login-script.md) · [PHP Jabbers Member Directory Script](https://agentprime.io/advisories/technology/php-jabbers-member-directory-script.md) · [PHP Jabbers Availability Calendar](https://agentprime.io/advisories/technology/php-jabbers-availability-calendar.md) · [PHP Jabbers PHP Event Calendar](https://agentprime.io/advisories/technology/php-jabbers-php-event-calendar.md) · [PHP Jabbers PHP Newsletter Script](https://agentprime.io/advisories/technology/php-jabbers-php-newsletter-script.md) · [PHP Jabbers Product Comparison Script](https://agentprime.io/advisories/technology/php-jabbers-product-comparison-script.md) · [PHP Jabbers Ticket Support Script](https://agentprime.io/advisories/technology/php-jabbers-ticket-support-script.md) · [PHP Jabbers PHP Shopping Cart](https://agentprime.io/advisories/technology/php-jabbers-php-shopping-cart.md) · [PHP Jabbers Auto Classifieds Script](https://agentprime.io/advisories/technology/php-jabbers-auto-classifieds-script.md)
- **Published:** 31 Jul 2026
- **Updated:** 31 Jul 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: CERT-PL) at 31 Jul 2026, 11:40 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: PHP Jabbers. Product: Appointment Scheduler.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Bus Reservation System.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Car Park Booking System.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Car Rental Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Cinema Booking System.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Event Booking Calendar.
  - affected: `before 5.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Event Ticketing System.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Hotel Booking System.
  - affected: `before 5.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Cleaning Business Software.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Equipment Rental Script.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Food Delivery Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Member Login Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Member Directory Script.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Availability Calendar.
  - affected: `before 6.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: PHP Event Calendar.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: PHP Newsletter Script.
  - affected: `before 5.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Product Comparison Script.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Ticket Support Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: PHP Shopping Cart.
  - affected: `before 6.0` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Auto Classifieds Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Business Directory Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Availability Booking Calendar.
  - affected: `before 6.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Time Slots Booking Calendar.
  - affected: `before 5.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Restaurant Booking System.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Shuttle Booking Software.
  - affected: `before 3.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Meeting Room Booking System.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Rental Property Booking Calendar.
  - affected: `before 3.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Service Booking Script.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Limo Booking Software.
  - affected: `before 2.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Taxi Booking Script.
  - affected: `before 3.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Job Listing Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Property Listing Script.
  - affected: `before 4.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Travel Tours Script.
  - affected: `before 3.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Vacation Rental Script.
  - affected: `before 5.1` (custom)
  - Other versions: unaffected
- Vendor: PHP Jabbers. Product: Yacht Listing Script.
  - affected: `before 3.1` (custom)
  - Other versions: unaffected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.6 High, CVSS 4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N`, from CNA (CERT-PL)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0038, the 32nd percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 31 Jul 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2025-67650](https://www.cve.org/CVERecord?id=CVE-2025-67650)
- [NVD: CVE-2025-67650](https://nvd.nist.gov/vuln/detail/CVE-2025-67650)

### References from the CNA

- <https://cert.pl/en/posts/2026/07/CVE-2025-67649/> (third-party-advisory)
- <https://www.phpjabbers.com/> (product)

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2025-67650>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2025-67650/>. Everything for agents: <https://agentprime.io/llms.txt>.