This vulnerability in STEdb Forms (versions <= 1.0.4) is due to improper neutralization of special elements used in SQL commands, leading to SQL Injection. An attacker with high privileges and no user interaction required could exploit this to cause a partial loss of confidentiality and availability. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope changed with high confidentiality impact and low availability impact. No vendor patch or advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to manipulate SQL queries, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact is high) and partial disruption of service (availability impact is low). Integrity impact is not indicated. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict access to STEdb Forms to trusted users with minimal privileges and monitor for suspicious database activity related to SQL injection attempts. Avoid exposing the affected versions to untrusted networks.