CVE record · CVE-2025-67651

CSRF in PHP Jabbers scripts

CVSS 6.9 MediumEPSS 0.0022 · 12th percentile

Published by the CVE Program (CNA: CERT-PL) at 31 Jul 2026, 11:40 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
PHP Jabbers	Appointment Scheduler	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Bus Reservation System	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Car Park Booking System	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Car Rental Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Cinema Booking System	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Event Booking Calendar	affected before 5.1 custom Other versions: unaffected
PHP Jabbers	Event Ticketing System	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Hotel Booking System	affected before 5.1 custom Other versions: unaffected
PHP Jabbers	Cleaning Business Software	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Equipment Rental Script	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Food Delivery Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Member Login Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Member Directory Script	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Availability Calendar	affected before 6.1 custom Other versions: unaffected
PHP Jabbers	PHP Event Calendar	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	PHP Newsletter Script	affected before 5.1 custom Other versions: unaffected
PHP Jabbers	Product Comparison Script	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Ticket Support Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	PHP Shopping Cart	affected before 6.0 custom Other versions: unaffected
PHP Jabbers	Auto Classifieds Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Business Directory Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Availability Booking Calendar	affected before 6.1 custom Other versions: unaffected
PHP Jabbers	Time Slots Booking Calendar	affected before 5.1 custom Other versions: unaffected
PHP Jabbers	Restaurant Booking System	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Shuttle Booking Software	affected before 3.1 custom Other versions: unaffected
PHP Jabbers	Meeting Room Booking System	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Rental Property Booking Calendar	affected before 3.1 custom Other versions: unaffected
PHP Jabbers	Service Booking Script	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Limo Booking Software	affected before 2.1 custom Other versions: unaffected
PHP Jabbers	Taxi Booking Script	affected before 3.1 custom Other versions: unaffected
PHP Jabbers	Job Listing Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Property Listing Script	affected before 4.1 custom Other versions: unaffected
PHP Jabbers	Travel Tours Script	affected before 3.1 custom Other versions: unaffected
PHP Jabbers	Vacation Rental Script	affected before 5.1 custom Other versions: unaffected
PHP Jabbers	Yacht Listing Script	affected before 3.1 custom Other versions: unaffected

Identifiers: CVE-2025-67651
CNA: CERT-PL
Weakness (CWE): CWE-352
Tags: PHP Jabbers Appointment Scheduler
PHP Jabbers Bus Reservation System
PHP Jabbers Car Park Booking System
PHP Jabbers Car Rental Script
PHP Jabbers Cinema Booking System
PHP Jabbers Event Booking Calendar
PHP Jabbers Event Ticketing System
PHP Jabbers Hotel Booking System
Cross-site request forgery (CSRF)
Published: 31 Jul 2026
Updated: 31 Jul 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.9	Medium	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	CNA (CERT-PL)

CISA KEV Not listed.
EPSS 0.0022, the 12th percentile, on 9 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 31 Jul 2026. New records show when each source confirmed them.

Sources

References from the CNA

cert.pl/en/posts/2026/07/CVE-2025-67649/ third-party-advisory
www.phpjabbers.com/ product

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.