The Milan Petrovic GD Rating System suffers from an SQL Injection vulnerability (CVE-2026-57771) caused by improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. This vulnerability affects all versions up to and including 3.7. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No official fix or patch has been confirmed as of the publication date. The vulnerability is not related to a cloud service, and no known exploits have been observed in the wild.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted. The vulnerability affects the confidentiality and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should restrict access to the affected system to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable system to untrusted networks. Apply any vendor updates promptly once available.