PT-2026-66747

CVE-2025-67649

Published

2026-07-31

Updated

2026-09-29

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PHP Jabbers - Car Rental Script versions prior to 4.1

Description Improper neutralization of user-provided input in parameters used for sorting functions allows an unauthenticated attacker to execute SQL Injection attacks. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update to version 4.1.

Exploitability

Fix

Impacts

Researchers

Kamil Szczurowski

Robert Kruczek

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers