This vulnerability (CVE-2026-10874) affects projectworlds Online Art Gallery Shop Project version 1.0. It arises from improper input handling of the 'social_insta' argument in an unknown function of the /admin/adminHome.php file, allowing an attacker to perform SQL injection. The attack vector is network-based with low attack complexity and no required privileges or user interaction. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires no privileges and no user interaction, increasing its risk. However, the CVSS impact metrics indicate low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the /admin/adminHome.php page to trusted administrators only and monitor for suspicious activity related to the 'social_insta' parameter. Avoid exposing the vulnerable interface to untrusted networks if possible.