Loading story…
CERT Polska disclosed five vulnerabilities affecting multiple PHP Jabbers products, including CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, and CVE-2026-46594. The issues include an unauthenticated SQL injection flaw in Car Rental Script exploitable through sorting parameters, an authenticated SQL injection flaw in PHP Poll Script via the pjAdminPolls.controller.php endpoint, and a reflected XSS flaw in PHP Poll Script. CERT Polska said the vulnerabilities were reported through coordinated disclosure and affect both individual products and broader portions of the vendor’s script portfolio.
CERT Polska also reported authenticated SQL injection and CSRF weaknesses affecting multiple PHP Jabbers scripts, with the CSRF issue allowing unauthorized administrative actions such as creating new admin accounts because of missing protections including CSRF tokens or appropriate SameSite cookie attributes. PHP Jabbers released fixes in version 4.1 for Car Rental Script and PHP Poll Script, while the remaining multi-product issues were remediated in product-specific fixed versions listed by CERT Polska.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT Polska published a coordinated disclosure covering five vulnerabilities in PHP Jabbers products. The disclosure described SQL injection flaws in Car Rental Script and PHP Poll Script, a reflected XSS flaw in PHP Poll Script, and authenticated SQL injection and CSRF issues affecting multiple PHP Jabbers scripts.
PHP Jabbers remediated the disclosed flaws in fixed releases, including version 4.1 for Car Rental Script and PHP Poll Script, with additional product-specific fixed versions for the broader multi-product issues. The fixes addressed unauthenticated and authenticated SQL injection, reflected XSS, and CSRF weaknesses.
CERT Polska reported that it received a report describing five vulnerabilities affecting PHP Jabbers scripts. The issues were identified as CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, and CVE-2026-46594.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecert.pl
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in Joomla! tracked as **`CVE-2015-8562`** allowed unauthenticated attackers to achieve remote code execution by sending crafted HTTP headers, including **`User-Agent`**, to vulnerable sites. The bug affected Joomla! versions **`1.5.0` through `3.4.5`** and was fixed in **`3.4.6`**. Researchers reported that exploitation was already occurring in the wild before the patch was released, with attackers abusing Joomla!'s session handling to write malicious serialized data into the backend MySQL session store and trigger code execution on a follow-up request. The exploit chain relied on multiple conditions: Joomla! stored session data in MySQL text fields, MySQL could silently truncate input containing 4-byte UTF-8 characters under configurations such as **`utf8_general_ci`**, and PHP session decoding behavior associated with **`CVE-2015-6835`** could turn the truncated data into attacker-controlled objects. The injected object chain then reached Joomla! components including **`JDatabaseDriverMysqli`** and **`SimplePie`**, ultimately invoking dangerous code paths such as **`assert()`**. Recommended mitigations included upgrading Joomla! and PHP, applying distribution patches, using **`utf8mb4`** where appropriate, and enabling stricter MySQL SQL modes to prevent silent truncation.
Aug 15, 2026
Three newly described **WordPress plugin vulnerabilities** affect ShopLentor, Advanced AJAX Product Filters, and WP Maps. **CVE-2026-1714** allows **unauthenticated email relay abuse** in *ShopLentor* (<= `3.3.2`) via the `woolentor_suggest_price_action` AJAX endpoint due to missing validation of parameters such as `send_to` and `product_title`; the `wlemail` parameter can be abused for **CRLF injection** to control sender details, enabling spam/phishing relay through the victim site. **CVE-2026-1426** is a **PHP object injection** issue in *Advanced AJAX Product Filters* (<= `3.1.9.6`) reachable by **authenticated users (Author+)** through deserialization of untrusted input in `shortcode_check` within a Live Composer compatibility layer; impact depends on the presence of a usable **POP chain** in another installed plugin/theme and requires the *Live Composer* plugin to be installed and active. **CVE-2025-12062** affects *WP Maps* (<= `4.8.6`) and enables **authenticated (Subscriber+) limited local file inclusion** via `fc_load_template`, potentially leading to sensitive data exposure or code execution in scenarios where attacker-controlled `.html` content can be uploaded and then included. Separately, Joomla sites using the **Novarain/Tassos Framework** (`plg_system_nrframework`) face critical issues enabling **unauthenticated file read, file deletion, and SQL injection**, which can be chained toward **administrator takeover** and potentially **persistent RCE**. The reported weaknesses stem from an AJAX handler that processes `task=include` without sufficient hardening, allowing attackers to reach internal classes implementing `onAjax` and abuse gadget-like behaviors (e.g., CSV loading for arbitrary file read, a `remove` action for path deletion, and attacker-influenced query construction for SQL injection). The risk propagates through multiple popular Tassos extensions that bundle the framework (including **Convert Forms**, **EngageBox**, **Google Structured Data**, **Advanced Custom Fields**, and **Smile Pack**), and remediation requires applying vendor updates for affected releases.
Jun 29, 2026
New CVE records document two high-severity web application vulnerabilities affecting **ThinkPHP 5.0.23** and **Ask Expert Script 3.0.5**. `CVE-2018-25270` describes an unauthenticated remote code execution flaw in ThinkPHP in which attackers can invoke functions through the routing parameter and send crafted requests to `index.php` to execute arbitrary PHP code. The issue is rated high impact across confidentiality, integrity, and availability under CVSS v3.1 and is referenced by public advisories and an Exploit-DB proof of concept. A separate entry, `CVE-2019-25676`, affects Ask Expert Script 3.0.5 and combines unauthenticated **cross-site scripting** and **SQL injection** weaknesses exposed through URL parameters. According to the record, attackers can inject script tags via the `cateid` parameter in `categorysearch.php` and inject SQL through the `view` parameter in `list-details.php`, potentially enabling browser-side code execution and database data extraction. The CVE maps the flaws to `CWE-79` and includes vendor, advisory, and exploit references, underscoring continued risk from exposed legacy PHP applications.
Jun 29, 2026