CVE-2018-25433 affects Joomla Component JE Photo Gallery version 1.1, containing an SQL injection vulnerability in the categoryid parameter. Unauthenticated attackers can exploit this vulnerability by sending crafted GET requests to index.php with malicious categoryid values in the com_jephotogallery component. The vulnerability allows execution of arbitrary SQL queries against the database. Attackers can extract sensitive information including usernames and password hashes. This represents a significant security risk for websites using the affected component version.