This vulnerability (CVE-2026-57662) involves improper neutralization of special elements used in SQL commands (CWE-89) in the Contest Gallery software by Wasiliy Strecker. It affects versions up to and including 30.0.0. The issue allows an attacker with low privileges and no user interaction to exploit the vulnerability remotely over the network, resulting in a confidentiality breach and partial denial of service. The CVSS 3.1 base score is 8.5, indicating high severity. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Exploitation of this SQL Injection vulnerability can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). There is no reported impact on data integrity. The vulnerability can be exploited remotely by an attacker with low privileges without requiring user interaction, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or restrict access to the affected functionality to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.