CVE-2026-3180

Name of the Vulnerable Software and Affected Versions Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe versions prior to 28.1.5

Description Unauthenticated attackers can perform blind SQL Injection, a technique used to extract information from a database by asking true or false questions through the application. This is possible due to insufficient escaping of user-supplied parameters and a lack of preparation in the existing SQL query. The issue allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database via the cgLostPasswordEmail and cgl mail parameters.

Recommendations Update to version 28.1.4 to resolve the issue related to the cgLostPasswordEmail parameter. Update to version 28.1.5 to resolve the issue related to the cgl mail parameter.