Phpjabbers vulnerabilities
We track 32 vulnerabilities in Phpjabbers products across 23 products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on December 17, 2025.
Latest Phpjabbers vulnerabilities
- 9.8 Critical severity
Simple CMS: Improper Neutralization of Special Elements used in an SQL Command
PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potent
- 9.8 Critical severity
Bus Reservation System: Improper Neutralization of Special Elements used in an SQL Command
Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, and time-based blind SQL injection techniques to steal informat
- 8.8 High severity
Meeting Room Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System O
- 8.8 High severity
Cinema Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options
- 8.8 High severity
Bus Reservation System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Bus Reservation System v1.1 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Option
- 7.5 High severity
Bus Reservation System: Uncontrolled Resource Consumption
A lack of rate limiting in the 'Forgot Password' feature of PHPJabbers Bus Reservation System v1.1 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount of generated e-mail
- 7.5 High severity
Restaurant Booking System: Uncontrolled Resource Consumption
A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Restaurant Booking System v3.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amoun
- 8.8 High severity
Restaurant Booking System: Improper Control of Generation of Code
PHPJabbers Restaurant Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Opt
- 8.8 High severity
Car Park Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Optio
- 8.8 High severity
Hotel Booking System: Improper Neutralization of Formula Elements in a CSV File
PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options
- 7.5 High severity
Hotel Booking System: Uncontrolled Resource Consumption
A lack of rate limiting in the "Login Section, Forgot Email" feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of reset requests for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount
- 7.5 High severity
Event Booking Calendar: Uncontrolled Resource Consumption
A lack of rate limiting in the 'Forgot Password', 'Email Settings' feature of PHPJabbers Event Booking Calendar v4.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service (DoS) via a large amount o
- 9.8 Critical severity
Cinema Booking System: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege es
- 9.3 Critical severity
Cinema Booking System: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields (event_img, seat_maps) and seat number configurations (number[new_X] in pjActionCreate). Attackers can inject persi
- 8.8 High severity
Limo Booking Software: Cross-Site Request Forgery
PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka an index.php?controller=pjAdminUsers&action=pjActionCreate URI.
- 7.5 High severity
Appointment Scheduler: Observable Discrepancy
User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Make An Offer Widget: Generation of Error Message Containing Sensitive Information
User enumeration is found in in PHPJabbers Make an Offer Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Ticket Support Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in in PHPJabbers Ticket Support Script v3.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Event Booking Calendar: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Event Booking Calendar v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Car Rental Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Car Rental Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Taxi Booking Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Fundraising Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Yacht Listing Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Hotel Booking System: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Restaurant Booking Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users
- 9.8 Critical severity
Document Creator: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Food Delivery Script: Generation of Error Message Containing Sensitive Information
User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 9.8 Critical severity
Callback Widget: Observable Discrepancy
User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.
- 8.8 High severity
Car Rental Script: Incorrect Permission Assignment for Critical Resource
In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 9.8 Critical severity
Cleaning Business Software: Insufficient Verification of Data Authenticity
In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 9.8 Critical severity
Class Scheduling System: Insufficient Verification of Data Authenticity
In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.
- 8.8 High severity
Time Slots Booking Calendar: Improper Authentication
In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.