Is there a public PoC exploit available for CVE-2026-14689?

Yes, a public proof-of-concept exploit is available for CVE-2026-14689. Prioritise patching immediately. EPSS: 0.2%.

Apartment Visitor Management System CVE-2026-14689

Q: What is the CVSS score of CVE-2026-14689?

CVE-2026-14689 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41711 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-25qc-p89r-xmj4

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint requiring low-privilege auth per CVSS 4.0 PR:L; limited C/I impact consistent with SQLi scope; no availability impact described in vulnerability data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:00 vuln.today

Severity Changed

Jul 05, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Apartment Visitor Management System 1.0. The impacted element is an unknown function of the file /apartment-visitor/add-apartment.php. The manipulation of the argument apartmentno results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 enables remote, low-privilege authenticated attackers to manipulate backend database queries via the apartmentno parameter in /apartment-visitor/add-apartment.php. The CVSS 4.0 score of 2.1 reflects a constrained impact scope (low C/I/A on the vulnerable system, no downstream system impact), but the presence of a publicly available proof-of-concept lowers the exploitation bar significantly. Real-world impact could extend beyond the CVSS score if the database user holds elevated permissions, potentially enabling unauthorized data extraction or record manipulation across the application's dataset. No public exploit identified via CISA KEV; no vendor patch identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based web application developed by CodeAstro for managing apartment visitors. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause as insufficient sanitization of user-supplied input - specifically, the apartmentno argument passed to the add-apartment.php endpoint is concatenated directly into a SQL query rather than handled via parameterized queries or prepared statements. The CPE string cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:* covers all versions, with EUVD-2026-41711 confirming version 1.0 as affected. The application is typical of PHP CRUD demo software that lacks input validation layers, ORM abstractions, or database query sanitization frameworks, making it structurally susceptible to injection-class vulnerabilities.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor the VulDB entry at https://vuldb.com/vuln/376285 for updates. The primary fix is to refactor add-apartment.php to replace dynamic SQL string concatenation with parameterized queries or PHP PDO/MySQLi prepared statements, which eliminates the injection surface entirely. As an immediate compensating control, apply server-side input validation to enforce that apartmentno accepts only numeric values, rejecting any input containing SQL metacharacters - note this is a defense-in-depth measure, not a substitute for prepared statements. Deploying a Web Application Firewall rule targeting SQL injection signatures on the /apartment-visitor/add-apartment.php endpoint can block automated scanning and known POC payloads, though WAF bypass techniques exist and this should not be the sole control. Additionally, restrict the application's database user to the minimum required privileges (e.g., SELECT/INSERT on specific tables only), limiting the data accessible via SQL injection even if exploited. Avoid granting FILE, DROP, or EXEC privileges to the application database account.