CVE-2025-67650 describes an authenticated SQL injection vulnerability in PHP Jabbers Appointment Scheduler. The vulnerability is due to improper neutralization of special elements in SQL commands, specifically in parameters controlling sorting functions. Authenticated users can exploit this flaw to perform SQL injection attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, data modification, or disruption of service. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to the minimum necessary and monitor for suspicious activity related to sorting parameters in the application.