Quick answers
- Is CVE-2025-67650 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-67650 being exploited in the wild.
- How severe is CVE-2025-67650?
- Informational severity, with a CVSS score of 8.6, published 31 July 2026.
- Which products and versions are affected?
- PHP Jabbers Appointment Scheduler before 4.1; PHP Jabbers Bus Reservation System before 2.1; PHP Jabbers Car Park Booking System before 4.1; PHP Jabbers Car Rental Script before 4.1; and 31 more.
- Is there a fix for CVE-2025-67650?
- A patch was published on 2026-07-31: Fixes released for affected products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-67650 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-67650?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authenticated SQL injection vulnerability (CWE-89) exists in multiple PHP Jabbers scripts due to improper neutralization of user-supplied input in parameters responsible for sorting functions. The vulnerability requires high privileges (PR:H) to exploit but allows for significant impact on data confidentiality and integrity (VC:H/VI:H). Attackers can manipulate SQL queries to extract or modify data from the database. The issue has been addressed in various updated versions across the product line, such as Appointment Scheduler 4.1 and Hotel Booking System 5.1.
Affected products
- PHP Jabbers Appointment Scheduler before 4.1
- PHP Jabbers Bus Reservation System before 2.1
- PHP Jabbers Car Park Booking System before 4.1
- PHP Jabbers Car Rental Script before 4.1
- PHP Jabbers Cinema Booking System before 2.1
- PHP Jabbers Event Booking Calendar before 5.1
- PHP Jabbers Event Ticketing System before 2.1
- PHP Jabbers Hotel Booking System before 5.1
- PHP Jabbers Cleaning Business Software before 2.1
- PHP Jabbers Equipment Rental Script before 2.1
- PHP Jabbers Food Delivery Script before 4.1
- PHP Jabbers Member Login Script before 4.1
- PHP Jabbers Member Directory Script before 2.1
- PHP Jabbers Availability Calendar before 6.1
- PHP Jabbers PHP Event Calendar before 4.1
- PHP Jabbers PHP Newsletter Script before 5.1
- PHP Jabbers Product Comparison Script before 2.1
- PHP Jabbers Ticket Support Script before 4.1
- PHP Jabbers PHP Shopping Cart before 6.0
- PHP Jabbers Auto Classifieds Script before 4.1
- PHP Jabbers, Business Directory Script before 4.1
- PHP Jabbers Availability Booking Calendar before 6.1
- PHP Jabbers Time Slots Booking Calendar before 5.1
- PHP Jabbers Restaurant Booking System before 4.1
- PHP Jabbers Shuttle Booking Software before 3.1
- PHP Jabbers Meeting Room Booking System before 2.1
- PHP Jabbers Rental Property Booking Calendar before 3.1
- PHP Jabbers Service Booking Script before 2.1
- PHP Jabbers Limo Booking Software before 2.1
- PHP Jabbers Taxi Booking Script before 3.1
- PHP Jabbers Job Listing Script before 4.1
- PHP Jabbers Property Listing Script before 4.1
- PHP Jabbers Travel Tours Script before 3.1
- PHP Jabbers Vacation Rental Script before 5.1
- PHP Jabbers Yacht Listing Script before 3.1
Timeline
- 2026-07-31: disclosed: Vulnerability disclosed by CERT.PL
- 2026-07-31: patched: Fixes released for affected products