Is there a public PoC exploit available for CVE-2026-14766?

Yes, a public proof-of-concept exploit is available for CVE-2026-14766. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro AVMS CVE-2026-14766

Q: What is the CVSS score of CVE-2026-14766?

CVE-2026-14766 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41776 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-r67f-r5w4-2xq5

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requiring low-privilege credentials (PR:L); partial confidentiality, integrity, and availability impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 05, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 19:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 05, 2026 - 19:21 vuln.today

DescriptionCVE.org

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/search-result.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the /apartment-visitor/search-result.php endpoint to remote exploitation via the searchdata POST parameter, allowing low-privileged authenticated attackers to read, modify, or partially disrupt underlying database contents. A public proof-of-concept exploit exists on GitHub, lowering the skill barrier for opportunistic attacks against any internet-facing deployment. No CISA KEV listing has been confirmed, and the CVSS 4.0 score of 5.3 reflects a limited partial-impact scope; however, the POC's availability meaningfully elevates real-world exploitation probability above what the score alone suggests.

Technical ContextAI

The affected product is a PHP-based web application identified by CPE cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the POST parameter searchdata submitted to /apartment-visitor/search-result.php is concatenated directly into a backend SQL query without parameterization or escaping. This classic PHP SQLi pattern allows an attacker to terminate the intended query and append arbitrary SQL, giving access to the database layer. The wildcard in the CPE version field suggests the flaw may span all released versions, not only 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis; the CPE wildcard and absence of a vendor security advisory mean patch status is unconfirmed. The primary fix is a code-level change to /apartment-visitor/search-result.php: replace dynamic SQL string concatenation with parameterized prepared statements (PDO or MySQLi), which eliminates the injection surface entirely. As an immediate compensating control, restrict access to the search endpoint to authenticated internal users through network-layer ACLs or HTTP authentication, which reduces but does not eliminate risk since PR:L exploitation remains feasible for any credentialed user. Deploying a WAF with SQLi signatures (e.g., ModSecurity CRS rule set) provides detection and partial blocking, though aggressive WAF rules may introduce false positives on legitimate search queries. Disabling the search functionality entirely until patched is the most reliable short-term mitigation with no false-positive trade-off. Monitor VulDB (https://vuldb.com/cve/CVE-2026-14766) and the vendor site (https://codeastro.com/) for patch releases.