Apartment Visitor Management System CVE-2026-14795

Exploitation requires a valid low-privilege authenticated session on the target application - an attacker must possess or acquire a user account (PR:L per CVSS 4.0 vector). The vulnerable endpoint is /apartment-visitor/action-visitor.php and the injection point is the remark parameter; no other special configuration or non-default setup is described as required beyond having the application reachable over the network. Exploitation is limited by the authentication requirement: unauthenticated attackers cannot directly trigger the vulnerability. No specific platform or OS dependency is stated beyond the PHP runtime. The application must be network-accessible (AV:N) for remote exploitation.

The CVSS 4.0 score of 5.3 reflects a medium-severity finding with network attack vector, low complexity, no attack requirements, but requiring low-privilege authentication (PR:L). The E:P supplemental metric confirms a public exploit exists, which materially lowers the effort bar for exploitation. KEV status is not confirmed, so this is not known to be under active mass exploitation. EPSS data was not provided; however, the combination of a simple SQL injection pattern and publicly available POC code suggests opportunistic exploitation is plausible against any internet-exposed instance. The low C/I/A impact ratings (all 'Low' in CVSS 4.0) likely reflect partial database access rather than full administrative takeover, though SQLi in PHP applications often enables deeper compromise depending on database user privileges. The primary limiting factor is the PR:L requirement - an attacker must first obtain a valid low-privilege account. This is a real but bounded risk, significantly reduced by the product's extremely narrow deployment footprint.

An attacker registers or obtains a low-privileged account on an internet-exposed instance of the Apartment Visitor Management System. They then craft an HTTP request to /apartment-visitor/action-visitor.php with a SQL injection payload in the remark field - for example, appending a UNION SELECT statement - to exfiltrate visitor records, credentials, or other database contents. A public POC on GitHub demonstrates this technique, meaning the attack requires minimal technical sophistication.