CSRF Vulnerability in PHP Jabbers Scripts
CVE-2025-67651

6.9MEDIUM

Key Information:

Vendor

PHP Jabbers

Status
Appointment Scheduler
Bus Reservation System
Car Park Booking System
Car Rental Script
Vendor
CVE Published:
31 July 2026

What is CVE-2025-67651?

A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in PHP Jabbers scripts, allowing attackers to perform unauthorized actions on behalf of authenticated users. This flaw arises from the absence of CSRF tokens and insufficient SameSite attributes, enabling malicious users to send unauthorized requests. Such actions could include creating new admin accounts, potentially compromising the integrity and security of the application. Updating affected versions is crucial to mitigate this vulnerability.

Affected Version(s)

Appointment Scheduler 0 < 4.1

Auto Classifieds Script 0 < 4.1

Availability Booking Calendar 0 < 6.1

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/
third-party-advisory
https://www.phpjabbers.com/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
.