This vulnerability (CVE-2026-9364) affects projectworlds Online Art Gallery Shop 1.0. It involves an SQL injection flaw triggered by manipulating the 'social_linked' parameter in the /admin/adminHome.php file. The attack vector is network-based with no privileges or user interaction required, and the vulnerability has low to limited scope and impact on confidentiality, integrity, and availability as per CVSS 4.0 metrics. The vulnerability is publicly disclosed with a published exploit, but no official fix or patch has been provided by the vendor. The product is not a cloud service, so remediation depends on vendor patching or user mitigation.

Successful exploitation allows remote attackers to perform SQL injection via the 'social_linked' parameter, potentially leading to unauthorized database queries or data manipulation. The CVSS 4.0 score of 6.9 indicates a medium severity impact with limited confidentiality, integrity, and availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider applying input validation or web application firewall (WAF) rules to block malicious input targeting the 'social_linked' parameter in /admin/adminHome.php.