CVE-2026-14795
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/action-visitor.php. An attacker can remotely manipulate the 'remark' argument to inject SQL code. The exploit has been publicly disclosed, increasing the risk of exploitation.
Risk Assessment
The organization is at risk of unauthorized database access, potentially leading to data leakage of visitor information, data modification or deletion, and system compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and use parameterized SQL queries.
Original NVD description (English source)
A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/action-visitor.php. Such manipulation of the argument remark leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.