The XooGallery Latest application contains an SQL injection flaw in the cat.php entry point that operates via the cat_id parameter. Unauthenticated attackers can manipulate database queries by sending a malicious cat_id in a GET request, causing the database to return or alter sensitive information. The weakness maps to CWE‑89, representing unvalidated input concatenated directly into SQL statements.

The vulnerability affects the Xooscripts XooGallery product, specifically the current release known as XooGallery Latest. Exact version numbers that contain the flaw are not listed; therefore any installation of the current release prior to a fixed patch is potentially exposed.

With a CVSS base score of 8.8 the flaw is classified as High severity. The EPSS score is below 1%, indicating the exploitation likelihood is considered low at this time, and it is not catalogued in the CISA KEV list. Attackers would need only a simple HTTP GET request containing a malicious cat_id value to exploit the issue. Because the injection occurs before authentication checks, an attacker can read or modify catalog data, potentially compromising sensitive information, but the impact does not include elevation of privileges beyond what the application already allows.