Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

PHP Poll Script: Malicious Code Execution via URL

CVE-2026-46594 · published 3 months ago
Summary

The PHP Poll Script contains a security flaw that allows an attacker to inject malicious code into a user's browser when they visit a specially crafted URL. This could potentially allow the attacker to steal sensitive information or take control of the user's session. To fix this issue, update to version 4.1 or later.

What to do
  • Update php jabbers php poll script to version 4.1 or later.
Affected software
VendorProductAffected versions
php jabbers php poll script < 4.1
Original advisory text
A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in a...
A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.
This issue was fixed in version 4.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Jul 2026
Updated4 Nov 2026
First seen31 Jul 2026
Sources
CVE-2026-46594 · NVD
CVE-2026-46594 · MITRE
Track software like this
Free during beta