Is there a patch available for CVE-2025-67651?

Yes, a patch is available for CVE-2025-67651. Update the affected software to the latest version immediately.

PHP Jabbers CVE-2025-67651

Q: What is the CVSS score of CVE-2025-67651?

CVE-2025-67651 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210568 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-31 cvd@cert.pl

GHSA-57h4-c69h-52fm

PHP CSRF

6.9

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-delivered CSRF (AV:N, AC:L) with no attacker privileges (PR:N), mandatory admin interaction (UI:R), and high integrity impact from admin account creation (I:H); no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 13:01 EUVD

Analysis Generated

Jul 31, 2026 - 12:32 vuln.today

DescriptionCVE.org

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.

This issue was fixed in the versions specified in the affected products list.

AnalysisAI

Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises here because the affected PHP Jabbers scripts issue no anti-CSRF tokens in state-changing HTML forms and do not enforce SameSite=Lax or SameSite=Strict attributes on session cookies. Without a CSRF token, the server cannot distinguish a legitimate admin action from a forged one submitted by an attacker-controlled page. Without SameSite cookie restrictions, browsers running on RFC 6265bis-non-compliant defaults will attach session cookies to any cross-origin POST, enabling the forgery. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N) confirms the attack is fully network-delivered, low-complexity, requires no attacker privileges, but demands active victim interaction. The affected codebase is PHP-based commercial scripting (booking systems, classifieds, etc.) as identified by the PHP tag and phpjabbers.com vendor attribution.

RemediationAI

Upgrade all affected PHP Jabbers scripts to the fixed versions identified in the vendor's affected products list, accessible via the PHP Jabbers website at https://www.phpjabbers.com/ and the CERT Poland advisory at https://cert.pl/en/posts/2026/07/CVE-2025-67649/. Exact patched version numbers are not confirmed in the current data set - consult those references directly before deploying updates. As an immediate compensating control, restrict access to PHP Jabbers admin panels to known IP ranges via firewall or web server ACL rules, which eliminates the network delivery vector entirely; note this may disrupt remote administration workflows. Alternatively, configure a reverse proxy or WAF to inject a SameSite=Strict attribute on session cookies and reject cross-origin POST requests to admin paths - effective but may break legitimate third-party integrations. Do not rely on browser SameSite defaults alone, as behavior varies across browser versions and enterprise configurations.