CVE-2025-67649

critical · 9.3

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

9.3

CVSS

0.3%

EPSS (exploit prob.)

20th

EPSS percentile

2026-07-31

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-89

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/
https://www.phpjabbers.com/car-rental-script/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-67649