Is there a public PoC exploit available for CVE-2026-14796?

Yes, a public proof-of-concept exploit is available for CVE-2026-14796. Prioritise patching immediately. EPSS: 0.2%.

Apartment Visitor Management System CVE-2026-14796

Q: What is the CVSS score of CVE-2026-14796?

CVE-2026-14796 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41807 LOW

SQL Injection (CWE-89)

2026-07-06 VulDB

GHSA-9pjx-8rrh-66hg

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L reflects mandatory low-privilege authentication; S:U and low C/I/A match SQLi bounded to partial database read/write with no lateral scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 06, 2026 - 04:51 vuln.today

DescriptionCVE.org

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. This affects an unknown part of the file /apartment-visitor/report.php. Performing a manipulation of the argument fromdate results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes backend database contents to authenticated low-privileged remote attackers via the unsanitized fromdate parameter in /apartment-visitor/report.php. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials. Publicly available exploit code has been published on GitHub (github.com/lilukun337/cve/issues/7), though no active exploitation has been confirmed by CISA KEV. The injection enables read and limited write access to the underlying database, with a moderate combined impact score of 5.3.

Technical ContextAI

The affected component is a PHP-based web application (CodeAstro Apartment Visitor Management System 1.0) identified by CPE cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*. The wildcard version field in the CPE string suggests all known releases may be affected. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic unsanitized input condition where the fromdate parameter passed to /apartment-visitor/report.php is concatenated directly into an SQL query without parameterization or escaping. This is a well-understood vulnerability class in PHP applications that fail to use prepared statements or PDO with bound parameters.

RemediationAI

No vendor-released patch or fix version has been identified at time of analysis; no advisory was found on the CodeAstro website (codeastro.com). Operators should apply the following compensating controls until an official fix is available. First, implement server-side input validation and enforce strict whitelisting of date formats for the fromdate parameter (e.g., YYYY-MM-DD only), rejecting any input containing SQL metacharacters - this directly addresses the injection vector with minimal functionality impact. Second, refactor the affected query in /apartment-visitor/report.php to use PHP PDO prepared statements with bound parameters, eliminating the root-cause vulnerability entirely. Third, deploy a web application firewall (WAF) rule to detect and block SQLi patterns on the /apartment-visitor/report.php endpoint; note that WAF rules can be bypassed by sophisticated attackers and are a defense-in-depth measure, not a permanent fix. Fourth, restrict access to the report endpoint to trusted IP ranges or require elevated authentication, reducing exposure to authenticated low-privileged accounts. Reference: https://vuldb.com/vuln/376390.