This vulnerability in Kleor Contact Manager arises from unsafe deserialization of untrusted data, enabling an attacker to perform object injection. The affected versions include all releases up to 9.1.1. Exploitation requires network access and user interaction but no privileges, and successful exploitation can result in high impact on confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting remote attack with low complexity and high impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability. This means attackers could potentially execute arbitrary code, manipulate data, or disrupt service. The vulnerability requires user interaction but no privileges, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor Kleor's advisories for updates. Until a fix is released, consider restricting access to the affected application and educating users to avoid interacting with untrusted data inputs that could trigger the vulnerability.