Which versions of PHP Poll Script are affected by CVE-2026-46593?

PHP Jabbers PHP Poll Script versions prior to 4.1 contain an SQL injection vulnerability in the administrative interface that allows privileged users to extract or modify poll data and backend…. A patch is available.

How to fix or mitigate CVE-2026-46593?

Within 24 hours, identify and inventory all systems running PHP Jabbers PHP Poll Script and document current versions to establish remediation scope. Within 7 days, upgrade all affected instances to version 4.1 or later to patch the SQL injection vulnerability in pjAdminPolls.controller.php. Within 30 days, conduct a database audit to detect and remediate any unauthorized access or data modifications that may have occurred prior to patching.

PHP Poll Script CVE-2026-46593

Q: What is the CVSS score of CVE-2026-46593?

CVE-2026-46593 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51526 HIGH

SQL Injection (CWE-89)

2026-07-31 cvd@cert.pl

GHSA-wp32-3jr9-wf9m

PHP SQLi

8.6

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Remote network endpoint with low complexity, but reaching pjAdminPolls.controller.php needs an admin session (PR:H); SQLi yields high confidentiality/integrity and limited availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 13:01 EUVD

Analysis Generated

Jul 31, 2026 - 12:31 vuln.today

CVE Published

Jul 31, 2026 - 12:16 cve.org

HIGH 8.6

DescriptionCVE.org

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.

AnalysisAI

SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.

Technical ContextAI

The affected component is PHP Jabbers PHP Poll Script, a commercial off-the-shelf PHP web application used to build and manage online polls/surveys, backed by a relational (typically MySQL) database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the pjAdminPolls.controller.php administrative controller incorporates request-supplied parameters directly into SQL statements without parameterization or adequate input sanitization, letting an attacker break out of the intended query context. Because the flaw sits in an admin-side controller, the entry point is reached through the application's authenticated administration interface rather than a public poll-voting page.

RemediationAI

Vendor-released patch: version 4.1 - upgrade all PHP Poll Script installations to 4.1 or later, which the vendor states resolves this SQL injection. Consult the vendor product page (https://www.phpjabbers.com/php-poll-script/) and the CERT.pl advisory (https://cert.pl/en/posts/2026/07/CVE-2025-67649/) for release details. If immediate upgrade is not possible, restrict reachability of the administrative interface (including the pjAdminPolls.controller.php endpoint) to trusted management networks or VPN, place a WAF rule in front of the admin controller to block SQL metacharacters in the affected parameters, and tighten admin account hygiene (strong unique credentials, MFA at the reverse-proxy layer, remove unused admin accounts) since exploitation requires an authenticated admin - note that network/WAF filtering can cause false positives on legitimate poll content and does not remove the underlying flaw. Grant the application's database user only the minimum privileges needed to limit the blast radius of a successful injection.