This vulnerability (CVE-2026-28142) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Shamalli Web Directory Free. It affects versions up to 1.7.13 and allows unauthenticated attackers to inject SQL commands. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with a scope change and high confidentiality impact but no integrity impact and low availability impact. The vulnerability is published and assigned by Patchstack but lacks a known remediation level or patch information.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database, leading to a complete confidentiality breach of the database contents. The integrity impact is not indicated, and availability impact is low, meaning the system may experience limited disruption. The scope is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected application and employing web application firewalls with SQL injection detection rules as temporary mitigations.