XooGallery Latest contains a SQL injection vulnerability in the gal_id parameter of gal.php. Unauthenticated attackers can exploit this vulnerability by sending malicious GET requests to manipulate database queries. The vulnerability allows attackers to extract sensitive database information or modify database contents. This represents a significant security risk as it requires no authentication and can lead to complete database compromise.