A Cross‑Site Request Forgery (CSRF) vulnerability was discovered in numerous PHP Jabbers scripts because the applications do not employ CSRF tokens or appropriate SameSite attributes. An attacker can craft a malicious request that is executed in the context of an authenticated administrator, allowing actions such as creating new administrative accounts. The result is a compromise of the integrity of the system’s administrative environment.

All PHP Jabbers scripts listed in the advisory—including Appointment Scheduler, Auto Classifieds Script, Availability Booking Calendar, Bus Reservation System, Business Directory Script, Car Rental Script, Hotel Booking System, Member Login Script, PHP Newsletter Script, PHP Shopping Cart, and numerous booking and listing modules—are affected. No specific version numbers are provided; the fix applies to the versions noted in the vendor’s affected‑product list.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of successful exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying it has not yet been observed in the wild. An attacker would likely need a victim’s authenticated session or a login cookie to deliver the forged request. If such a session exists, the lack of CSRF protection allows the attacker to perform privileged actions without the user’s consent.