This vulnerability (CVE-2026-57642) affects bestwebsoft Gallery versions <=4.7.8 and is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It allows an attacker with low privileges to perform SQL Injection attacks remotely without user interaction. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality loss and low availability impact. No official fix or patch is currently documented.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, increasing the risk of remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.