CVE-2025-67651

MediumCVSS 6.9

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in multiple PHP Jabbers scripts allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

Risk Assessment

The risk is unauthorized administrative actions by an attacker, potentially leading to full compromise of the application.

Recommendation

Upgrade all affected PHP Jabbers scripts to the versions specified in the affected products list.

Other vulnerabilities in PHP Jabbers scripts

CVE-2025-67650High
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. An authenticated user can manipulate parameters responsible for sorting functions, leading to unauthorized SQL queries. This issue was fixed in the versions specified in the affected products list.

Original NVD description (English source)

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.