Is there a patch available for EUVD-2026-51527?

Yes, a patch is available for EUVD-2026-51527. Update the affected software to the latest version immediately.

PHP Poll Script EUVD-2026-51527

Q: What is the CVSS score of EUVD-2026-51527?

EUVD-2026-51527 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-46594 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-31 cvd@cert.pl

GHSA-4m43-9f84-rm49

PHP XSS

5.1

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network delivery, no privileges required, but user must click crafted URL; scope changes to victim browser with low confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 13:01 EUVD

Analysis Generated

Jul 31, 2026 - 12:32 vuln.today

DescriptionCVE.org

A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1.

AnalysisAI

Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.

Technical ContextAI

PHP Poll Script is a commercial PHP-based web application sold by PHP Jabbers for embedding voting/polling functionality into websites. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input in a URL parameter is reflected into the HTML/JavaScript response without adequate sanitization or output encoding. This is a classic reflected XSS pattern: the server echoes attacker-controlled input back to the requesting browser within a page response, causing the victim's browser to parse and execute injected script. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network delivery with no special attack prerequisites, though active user interaction is required. Subsequent-system impact metrics SC:L/SI:L reflect that exploitation affects the victim's browser context, not the server itself.

RemediationAI

Upgrade PHP Poll Script to version 4.1, which the vendor confirms resolves this issue. The fix is referenced by the vendor at https://www.phpjabbers.com/php-poll-script/. If immediate upgrade is not possible, a compensating control is to implement a web application firewall (WAF) rule to detect and block reflected XSS payloads in query parameters directed at the affected script - most WAF vendors include CWE-79 signatures. Additionally, Content-Security-Policy (CSP) headers configured to disallow inline script execution (script-src 'self') would significantly reduce the impact of any successful XSS injection, though this may require testing for compatibility with the application's own JavaScript. Note that WAF and CSP are mitigations only; upgrading to 4.1 is the definitive fix.