Is there a public PoC exploit available for CVE-2026-14640?

Yes, a public proof-of-concept exploit is available for CVE-2026-14640. Prioritise patching immediately. EPSS: 0.3%.

Apartment Visitor Management CVE-2026-14640

Q: What is the CVSS score of CVE-2026-14640?

CVE-2026-14640 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41688 MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

PHP SQLi Apartment Visitor Management System Codeastro

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Login form is network-exposed with no auth required (AV:N/PR:N); partial CIA impacts reflect typical SQL injection read/write without evidence of full database control or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 04, 2026 - 19:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 04, 2026 - 19:16 vuln.today

DescriptionCVE.org

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites for exploitation, and the E:P modifier reflects a publicly available proof-of-concept on GitHub. No CISA KEV listing was found at time of analysis, but the combination of an exposed login surface, no authentication barrier, and live POC code materially elevates practical risk beyond the medium CVSS score of 6.9.

Technical ContextAI

The affected application is a PHP-based web system (CodeAstro Apartment Visitor Management System 1.0) designed for residential visitor tracking. The vulnerable component is the Login handler in /index.php, where the Username form parameter is passed directly - or with insufficient sanitization - into a SQL query, constituting a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. The CPE string cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range beyond the known 1.0 release. PHP applications that build queries via string concatenation rather than prepared statements are the canonical source of this weakness class, and login forms are particularly high-value targets because they are always publicly exposed and frequently lack WAF coverage.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed version is independently confirmable from the provided data. Organizations should immediately restrict network-level access to the /index.php login endpoint using firewall rules or reverse-proxy ACLs to limit exposure to trusted IP ranges, accepting the trade-off of reduced accessibility for remote staff. Deploying a Web Application Firewall rule that blocks common SQL injection patterns (single quotes, UNION, SELECT, comment sequences) in the Username parameter is a viable compensating control, though it carries a low risk of false positives on usernames with special characters. If the application is internet-facing with no business requirement, taking it offline until a patch is available is the safest option. Contact the vendor at https://codeastro.com/ to request a patched release. Monitor VulDB at https://vuldb.com/vuln/376156 for updated patch status.