CVE-2025-67650Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR92d
Disclosure
🚨High - PHP Jabbers Scripts Authenticated SQLi via ORDER BY Sort Params (CVE-2025-67650) Multiple PHP Jabbers PHP scripts fail to neutralize user-controlled sort parameters passed into SQL sorting/ORDER BY logic, enabling authenticated SQL injection against the backend database. Instances running at or above the vendor “lessThan” fixed thresholds are not affected. 👉Affected: PHP Jabbers scripts (versions below vendor fixed lessThan thresholds)
Post summary
The text announces a high‑severity authenticated SQL injection vulnerability (CVE‑2025‑67650) affecting older PHP Jabbers scripts, noting that vendor‑fixed thresholds mitigate the issue.
0000078
275 followersView on X

Explore more

Back to dashboard