CVE-2025-26971 describes an improper neutralization of special elements used in an SQL command (SQL Injection) in Ays Pro Poll Maker. This vulnerability enables Blind SQL Injection attacks on affected versions up to 5.6.5. The CVSS 3.1 score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and scope changed. The impact includes high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is provided, and the product is not a cloud service.

An attacker with high privileges can exploit this vulnerability remotely over the network to perform Blind SQL Injection, potentially exposing sensitive data (high confidentiality impact). The integrity of data is not impacted, but availability may be slightly affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to the Poll Maker application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the application to untrusted networks where possible.