CVE-2025-67650: PHP Jabbers Appointment Scheduler

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

Affected products

  • PHP Jabbers Appointment Scheduler: before 4.1 (fixed in 4.1)
  • PHP Jabbers Auto Classifieds Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers Availability Booking Calendar: before 6.1 (fixed in 6.1)
  • PHP Jabbers Availability Calendar: before 6.1 (fixed in 6.1)
  • PHP Jabbers Bus Reservation System: before 2.1 (fixed in 2.1)
  • PHP Jabbers Business Directory Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers Car Park Booking System: before 4.1 (fixed in 4.1)
  • PHP Jabbers Car Rental Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers Cinema Booking System: before 2.1 (fixed in 2.1)
  • PHP Jabbers Cleaning Business Software: before 2.1 (fixed in 2.1)
  • PHP Jabbers Equipment Rental Script: before 2.1 (fixed in 2.1)
  • PHP Jabbers Event Booking Calendar: before 5.1 (fixed in 5.1)
  • PHP Jabbers Event Ticketing System: before 2.1 (fixed in 2.1)
  • PHP Jabbers Food Delivery Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers Hotel Booking System: before 5.1 (fixed in 5.1)
  • PHP Jabbers Job Listing Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers Limo Booking Software: before 2.1 (fixed in 2.1)
  • PHP Jabbers Meeting Room Booking System: before 2.1 (fixed in 2.1)
  • PHP Jabbers Member Directory Script: before 2.1 (fixed in 2.1)
  • PHP Jabbers Member Login Script: before 4.1 (fixed in 4.1)
  • PHP Jabbers PHP Event Calendar: before 4.1 (fixed in 4.1)
  • PHP Jabbers PHP Newsletter Script: before 5.1 (fixed in 5.1)
  • PHP Jabbers PHP Shopping Cart: before 6.0 (fixed in 6.0)
  • PHP Jabbers Product Comparison Script: before 2.1 (fixed in 2.1)
  • PHP Jabbers Property Listing Script: before 4.1 (fixed in 4.1)
  • and 10 more

Published 2026-07-31. Last modified 2026-09-29.