CVE-2005-3508
HighSummary
SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, potentially leading to a breach of system confidentiality and integrity.
Recommendation
Immediately update the Gallery application to the latest available version that includes a fix for the SQL injection vulnerability.
Related vulnerabilities
- CVE-2026-57116Critical
In PraisonAI from version 4.2.1 to before 4.6.59, the AgentOS FastAPI deployment surface remains unauthenticated despite the earlier fix for CVE-2026-40151. The chat route directly calls agent.chat(request.message), and both no-auth and wrong-bearer requests execute the deployed agent.
- CVE-2026-112859Critical
The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.
- CVE-2026-112858Critical
The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.
- CVE-2026-112857Critical
The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.
- CVE-2026-112856Critical
The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.
- CVE-2026-112855Critical
The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.
- CVE-2026-112854Critical
The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.
- CVE-2026-112853Critical
The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.
- CVE-2026-112851Critical
The HotLock WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects HotLock from n/a through 1.3.9.
- CVE-2026-112848Critical
A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.
Original NVD description (English source)
SQL injection vulnerability in showGallery.php in Gallery (Galerie) 2.4 allows remote attackers to execute arbitrary SQL commands via the galid parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS