SQL Injection Vulnerability in PHP Jabbers PHP Poll Script
CVE-2026-46593

8.6HIGH

Key Information:

Vendor

PHP Jabbers

Status
PHP Poll Script
Vendor
CVE Published:
31 July 2026

What is CVE-2026-46593?

A critical SQL injection flaw has been discovered in the PHP Jabbers PHP Poll Script, which allows attackers to exploit the pjAdminPolls.controller.php endpoint. This vulnerability arises from improper handling of user inputs, enabling authenticated users to execute unauthorized SQL queries. Such attacks can compromise database integrity and lead to unauthorized data access. The issue was addressed in the updated version 4.1 of the software, underscoring the importance of using the latest versions to ensure security.

Affected Version(s)

PHP Poll Script 0 < 4.1

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/
third-party-advisory
https://www.phpjabbers.com/php-poll-script/
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
.