This vulnerability is a classic SQL injection flaw in the contactno parameter of the forgot-password page. It allows an unauthenticated attacker to manipulate the SQL query used for authentication and obtain sensitive information from the underlying database. The weakness aligns with CWE-89, where user input is directly concatenated into an SQL statement without proper sanitization.

The affected application is the Apartment Visitors Management System version 1.1. No other vendors or products are explicitly mentioned, so this is the only known vulnerable instance.

The attack vector is inferred to be a web application interface that accepts the contactno field. Since the flaw permits unauthenticated exploitation and can reveal database contents, the risk is high. The CVSS score is 8.2, and EPSS data is not available, and the vulnerability is not listed in the KEV catalog. The lack of publicly disclosed exploits in the KEV table does not diminish the severity but indicates that it has not yet been widely exploited.