Is there a public PoC exploit available for CVE-2026-14795?

Yes, a public proof-of-concept exploit is available for CVE-2026-14795. Prioritise patching immediately. EPSS: 0.2%.

Apartment Visitor Management System CVE-2026-14795

Q: What is the CVSS score of CVE-2026-14795?

CVE-2026-14795 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41806 LOW

SQL Injection (CWE-89)

2026-07-06 VulDB

GHSA-q254-x8fp-qh6m

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requires low-privilege auth (PR:L); partial DB read/write impact maps to C:L/I:L/A:L with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 06, 2026 - 04:51 vuln.today

DescriptionCVE.org

A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/action-visitor.php. Such manipulation of the argument remark leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows authenticated remote attackers to manipulate database queries through the remark parameter of /apartment-visitor/action-visitor.php. A low-privileged user can extract, modify, or delete underlying database contents. A public proof-of-concept exploit has been disclosed on GitHub (no public exploit identified as CISA KEV, but POC availability lowers the bar for exploitation).

Technical ContextAI

The affected product is a PHP-based web application by CodeAstro, identified via CPE cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*, version 1.0. The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The PHP script /apartment-visitor/action-visitor.php accepts a remark POST/GET parameter and incorporates it into a SQL query without adequate sanitization or parameterization, a classic unsanitized input-to-query construction pattern common in beginner-grade PHP applications that do not use prepared statements or ORM layers.

RemediationAI

No vendor-released patch has been identified at the time of analysis. CodeAstro should apply parameterized queries or prepared statements to all user-supplied inputs in /apartment-visitor/action-visitor.php, specifically the remark parameter, as the primary fix. Until a patch is available, defenders should restrict network access to the application to trusted IP ranges only, blocking public internet exposure of the management interface. Deploying a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in the remark parameter can reduce exploitation risk, though WAF rules can be bypassed and should not be treated as a permanent fix. Reviewing and hardening the database user account permissions to enforce least privilege - allowing only SELECT/INSERT/UPDATE on required tables rather than administrative rights - limits the blast radius if exploitation occurs. The public POC is tracked at https://github.com/lilukun337/cve/issues/6.