This vulnerability in ZoomIt DZS Video Gallery (<= 12.39) involves improper neutralization of special elements used in SQL commands, leading to SQL Injection. An attacker with low privileges and no user interaction can exploit this remotely over the network. The CVSS 3.1 base score is 8.5, reflecting high impact on confidentiality and low impact on availability, with no integrity impact. The vulnerability is publicly disclosed but lacks vendor patch or mitigation details.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (confidentiality impact is high). The availability impact is low, and integrity is not affected. The attacker requires low privileges and no user interaction, increasing the risk of exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.