This vulnerability (CVE-2026-49771) in 10Web Photo Gallery (<=1.8.41) is an improper neutralization of special elements in SQL commands (CWE-89), enabling Blind SQL Injection attacks. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with high privileges can exploit this vulnerability remotely to perform Blind SQL Injection, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to availability. Integrity is not impacted according to the CVSS vector. The scope of impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to high-privilege accounts and monitor for suspicious activity related to SQL injection attempts. Avoid exposing vulnerable versions in untrusted environments.