This vulnerability in ARForms arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. It affects all versions up to 6.4. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with low privileges to execute SQL Injection attacks, potentially leading to partial denial of service and unauthorized disclosure of sensitive information. Integrity impact is not indicated. The vulnerability could compromise confidentiality of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider applying any recommended temporary mitigations once published.