CVE-2025-67651: PHP Jabbers Appointment Scheduler

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

Affected products

• PHP Jabbers Appointment Scheduler: before 4.1 (fixed in 4.1)
• PHP Jabbers Auto Classifieds Script: before 4.1 (fixed in 4.1)
• PHP Jabbers Availability Booking Calendar: before 6.1 (fixed in 6.1)
• PHP Jabbers Availability Calendar: before 6.1 (fixed in 6.1)
• PHP Jabbers Bus Reservation System: before 2.1 (fixed in 2.1)
• PHP Jabbers Business Directory Script: before 4.1 (fixed in 4.1)
• PHP Jabbers Car Park Booking System: before 4.1 (fixed in 4.1)
• PHP Jabbers Car Rental Script: before 4.1 (fixed in 4.1)
• PHP Jabbers Cinema Booking System: before 2.1 (fixed in 2.1)
• PHP Jabbers Cleaning Business Software: before 2.1 (fixed in 2.1)
• PHP Jabbers Equipment Rental Script: before 2.1 (fixed in 2.1)
• PHP Jabbers Event Booking Calendar: before 5.1 (fixed in 5.1)
• PHP Jabbers Event Ticketing System: before 2.1 (fixed in 2.1)
• PHP Jabbers Food Delivery Script: before 4.1 (fixed in 4.1)
• PHP Jabbers Hotel Booking System: before 5.1 (fixed in 5.1)
• PHP Jabbers Job Listing Script: before 4.1 (fixed in 4.1)
• PHP Jabbers Limo Booking Software: before 2.1 (fixed in 2.1)
• PHP Jabbers Meeting Room Booking System: before 2.1 (fixed in 2.1)
• PHP Jabbers Member Directory Script: before 2.1 (fixed in 2.1)
• PHP Jabbers Member Login Script: before 4.1 (fixed in 4.1)
• PHP Jabbers PHP Event Calendar: before 4.1 (fixed in 4.1)
• PHP Jabbers PHP Newsletter Script: before 5.1 (fixed in 5.1)
• PHP Jabbers PHP Shopping Cart: before 6.0 (fixed in 6.0)
• PHP Jabbers Product Comparison Script: before 2.1 (fixed in 2.1)
• PHP Jabbers Property Listing Script: before 4.1 (fixed in 4.1)
• and 10 more

Published 2026-07-31. Last modified 2026-09-29.