PT-2026-66747 · Phpjabbers · Car Rental Script

Kamil Szczurowski + 1 · CVE-2025-67649 · Published 2026-07-31 · Updated 2026-07-31

NVD

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 4.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67649

Affected Products

Car Rental Script

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-67649 · Security Note
• https://phpjabbers.com/car-rental-script · Note
• https://cert.pl/en/posts/2026/07/CVE-2025-67649 · Note