Threat database

A reflected cross-site scripting (XSS) vulnerability exists in PHP Jabbers PHP Poll Script versions prior to 4.1. This flaw allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser when opened. The vulnerability is fixed in version 4.1.

A SQL injection vulnerability exists in PHP Jabbers PHP Poll Script allowing an authenticated attacker to exploit improper input neutralization in the pjAdminPolls.controller.php endpoint. This vulnerability enables high-impact SQL injection attacks. The issue was fixed in version 4.1. The vulnerability has a high CVSS 4.0 score of 8.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple PHP Jabbers Appointment Scheduler scripts due to missing CSRF tokens or appropriate SameSite cookie attributes. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users, including creating new administrative accounts. The vulnerability has a medium severity score of 6.9 and has been assigned CVE-2025-67651. The issue is known and published but no specific affected versions or patches have been provided in the available data.

CVE-2025-67650 is an authenticated SQL injection vulnerability in multiple PHP Jabbers scripts, specifically in the Appointment Scheduler product. The flaw arises from improper neutralization of input provided by authenticated users in parameters related to sorting functions, enabling SQL injection attacks. This vulnerability has a high severity score of 8.6 and was published in July 2026. The issue has been fixed in certain versions, though those specific versions are not listed in the provided data.

A critical SQL injection vulnerability exists in PHP Jabbers Car Rental Script versions prior to 4.1. The flaw arises from improper neutralization of user input in parameters used for sorting functions, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability has a CVSS 4.0 score of 9.3, indicating high severity. The issue was fixed in version 4.1.