The vulnerability is a SQL injection flaw in Joomla! Component KissGallery 1.0.0. Unauthenticated users can supply malicious SQL code in the component's URL path, enabling them to execute arbitrary database queries. This can lead to data exfiltration, credential theft, or unintended database modifications, as the weakness is identified as CWE‑89.

The affected product is Joomla! Component KissGallery 1.0.0 sold by Terrywcarter. No other product versions are listed, so earlier releases are assumed not affected, but the component version 1.0.0 must be considered vulnerable.

The vulnerability has a CVSS score of 8.8, indicating high impact. EPSS is not available, and it is not listed in the CISA KEV catalog, but the score alone marks it as a severe risk. Because the flaw can be exploited via a standard HTTP request to the component URL, the attack vector is remote and does not require authentication. An attacker could therefore immediately gain database access if the system is exposed to the internet. The high severity combined with the unauthenticated nature of the flaw suggests a significant risk of exploitation.