Exploitation timeline
Threadlinqs has recorded 5 PHP Jabbers CVEs published between and . The busiest month was 2026-07 (5 new CVEs). None of them is listed in CISA KEV yet.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked PHP Jabbers CVEs.
- CVE-2026-46594medium 5.1EPSS 0.6%
- CVE-2025-67650high 8.6EPSS 0.4%
- CVE-2026-46593high 8.6EPSS 0.4%
- CVE-2025-67651medium 6.9EPSS 0.2%
- CVE-2025-67649critical 9.3
Products affected
Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 13 distinct PHP Jabbers products are affected. The most frequently affected:
- Car Rental Script 3 CVEs
- Appointment Scheduler 2 CVEs
- Bus Reservation System 2 CVEs
- Car Park Booking System 2 CVEs
- Cinema Booking System 2 CVEs
- Cleaning Business Software 2 CVEs
- Equipment Rental Script 2 CVEs
- Event Booking Calendar 2 CVEs
- Event Ticketing System 2 CVEs
- Food Delivery Script 2 CVEs
- Hotel Booking System 2 CVEs
- Member Login Script 2 CVEs
- PHP Poll Script 2 CVEs
Threat activity
1 tracked threat campaign reference PHP Jabbers products or exploit PHP Jabbers CVEs:
How to prioritise PHP Jabbers patching
This order follows the data Threadlinqs holds for PHP Jabbers, not a generic severity checklist:
- No PHP Jabbers CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are CVE-2026-46594 (0.6%), CVE-2025-67650 (0.4%), CVE-2026-46593 (0.4%).
- 1 CVE scores Critical and 2 High on CVSS v3 (maximum 9.3, average 7.7); sequence these after KEV and high-EPSS items.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-12 and refresh daily.