CVE-2026-14798
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in CodeAstro Apartment Visitor Management System 1.0 in the visitor-entry.php file. Remote attackers can manipulate the visname argument to inject SQL. The exploit is publicly available.
Risk Assessment
The organization risks remote database compromise, leakage of visitor data, and potential privilege escalation within the system.
Recommendation
Apply the vendor patch immediately or temporarily disable access to visitor-entry.php. Implement input validation and parameterized SQL queries.
Original NVD description (English source)
A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /apartment-visitor/visitor-entry.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.