This vulnerability in Kleor Contact Manager arises from unsafe deserialization of untrusted data, enabling object injection attacks. It affects all versions up to and including 9.1.1. The CVSS v3.1 base score is 8.8, indicating a high impact with network attack vector, low attack complexity, requiring low privileges and no user interaction, and resulting in high confidentiality, integrity, and availability impacts. No patch or vendor advisory details are available to confirm remediation status.

Successful exploitation could allow an attacker with low privileges to remotely execute arbitrary code or manipulate application behavior, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in data breaches, unauthorized data modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the application and monitoring for suspicious activity related to deserialization processes. Avoid processing untrusted serialized data where possible.