Is CVE-2026-46593 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46593 being exploited in the wild.

How severe is CVE-2026-46593?

Informational severity, with a CVSS score of 8.6, published 31 July 2026.

Which products and versions are affected?

PHP Jabbers PHP Poll Script All versions before 4.1.

Is there a fix for CVE-2026-46593?

A patch was published on 2026-07-31: Fixed in version 4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46593 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46593?

Check whether you run PHP Jabbers PHP Poll Script at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46593: PHP Jabbers PHP Poll Script SQL injection in pjAdminPolls.controller.php

CVE-2026-46593 · Severity: info · CVSS 8.6 · Published 2026-07-31

PHP Jabbers PHP Poll Script, a tool used to create and manage online voting and surveys, contains a security vulnerability in its administrative interface. An attacker with administrative credentials can inject malicious database commands, potentially allowing them to view, modify, or delete sensitive data stored in the application's database. This could lead to a complete compromise of the polling data and the underlying database server.

Vendors: PHP Jabbers.

Quick answers

Is CVE-2026-46593 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46593 being exploited in the wild.
How severe is CVE-2026-46593?: Informational severity, with a CVSS score of 8.6, published 31 July 2026.
Which products and versions are affected?: PHP Jabbers PHP Poll Script All versions before 4.1.
Is there a fix for CVE-2026-46593?: A patch was published on 2026-07-31: Fixed in version 4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46593 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46593?: Check whether you run PHP Jabbers PHP Poll Script at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the PHP Jabbers PHP Poll Script due to improper neutralization of user-supplied input within the pjAdminPolls.controller.php endpoint. The flaw allows an authenticated attacker with high privileges (administrative access) to submit specially crafted input that alters the intended SQL queries. Successful exploitation can lead to unauthorized data disclosure, modification, or deletion within the database. The vulnerability is addressed in version 4.1 of the script.

Affected products

PHP Jabbers PHP Poll Script All versions before 4.1

Timeline

2026-07-31: advisory: Initial disclosure by CERT Polska and NVD publication.
2026-07-31: patched: Fixed in version 4.1.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.