The cybio Gallery Widget up to version 1.2.1 suffers from an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with low privileges to execute arbitrary SQL queries remotely without user interaction. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, and partial privileges required. The vulnerability affects confidentiality severely, with limited impact on availability and no impact on integrity. No patch or vendor advisory is currently provided.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The integrity of data is not impacted, and availability impact is low. The vulnerability requires low privileges and no user interaction, making it relatively easy to exploit remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Gallery Widget and monitor for suspicious activity related to SQL queries. Avoid exposing the widget to untrusted networks or users with low privileges.