This vulnerability involves improper neutralization of special elements in SQL commands within the Easy Form Builder product by hassantafreshi, enabling blind SQL injection attacks. It affects all versions up to 4.0.6. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact includes high confidentiality loss and low availability impact. No official remediation or patch information is currently available.

An attacker can exploit this vulnerability remotely without authentication to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or other SQL injection mitigations to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.