The vulnerability resides in XooGallery's results.php file, where the 'p' parameter is incorporated into database queries without proper sanitization. Exploitation allows an unauthenticated attacker to inject arbitrary SQL statements. Successful injection can bypass authentication checks, read confidential database information, or alter or delete records. The weakness is a classic SQL Injection (CWE‑89).

Xooscripts XooGallery is the affected product. No specific affected version range is supplied in the available data, so all current releases of XooGallery remain potentially vulnerable until an official update is released.

The CVSS score of 8.8 categorizes the issue as high severity, and the EPSS score indicates a very low probability of exploitation in the wild. The vulnerability is accessible over the public internet via a simple HTTP GET request to results.php, making it remotely exploitable without authentication. While no known active exploits are reported and it is absent from the CISA KEV catalog, the impact—unauthenticated data exfiltration or modification—warrants immediate attention.