Authenticated SQL Injection in PHP Poll Script
Priority LOW 39CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed PHP Poll Script (PHP Jabbers): 4.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHP Jabbers | PHP Poll Script | before 4.1 | 4.1 | Patch available | CNA |
- PHP Poll Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
Remediation
- Fix · CNA PHP Poll Script (PHP Jabbers) Fixed in 4.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
PHP Poll Script 4.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-34254 Reflected XSS in PHP Poll ScriptPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46593
- 2026-10-03 Alias added: GHSA-wp32-3jr9-wf9m
References
More PHP Jabbers vulnerabilities
- TI-2023-03812 PHP Jabbers Taxi Booking index.php cross site scripting CVSS 3.1MEDIUM 6.1
- TI-2023-03806 PHP Jabbers Availability Booking Calendar index.php cross site scripting CVSS 3.1MEDIUM 6.1
- TI-2025-41392 Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script CVSS 4.0CRITICAL 9.3
- TI-2025-41393 Authenticated SQL Injection in PHP Jabbers scripts CVSS 4.0HIGH 8.6
- TI-2023-03811 PHP Jabbers Cleaning Business index.php cross site scripting CVSS 3.1MEDIUM 6.1
- TI-2023-03810 PHP Jabbers Night Club Booking Software index.php cross site scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-46593 · CVE Program
- CVE-2026-46593 · NVD
- FIRST EPSS
- GHSA-wp32-3jr9-wf9m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences