CVE-2025-67650

HighCVSS 8.6

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. An authenticated user can manipulate parameters responsible for sorting functions, leading to unauthorized SQL queries. This issue was fixed in the versions specified in the affected products list.

Risk Assessment

An authenticated attacker can gain unauthorized access to the database, leading to data leakage or modification of application data.

Recommendation

Update all affected PHP Jabbers scripts to the patched versions.

Other vulnerabilities in PHP Jabbers scripts

CVE-2025-67651Medium
A Cross-Site Request Forgery (CSRF) vulnerability in multiple PHP Jabbers scripts allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

Original NVD description (English source)

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.