This vulnerability involves an SQL Injection in the Apartment Visitors Management System V1.1, specifically in the email parameter of the forgot-password.php page. It allows an unauthenticated attacker to alter SQL queries executed by the backend, which can lead to unauthorized access to sensitive user information. No official patch or remediation guidance is currently available, and no exploits have been reported in the wild.

Successful exploitation could allow attackers to retrieve sensitive user data from the backend database without authentication. This compromises user privacy and system confidentiality. No further impact details or exploitation reports are available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the forgot password functionality if possible and monitor for unusual activity related to this endpoint.