Is there a public PoC exploit available for CVE-2026-14798?

Yes, a public proof-of-concept exploit is available for CVE-2026-14798. Prioritise patching immediately. EPSS: 0.2%.

Apartment Visitor Management System CVE-2026-14798

Q: What is the CVSS score of CVE-2026-14798?

CVE-2026-14798 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41809 LOW

SQL Injection (CWE-89)

2026-07-06 VulDB

GHSA-gvmh-j88v-pwfv

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQLi with low-privilege auth requirement; impact is limited and contained to the vulnerable system with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 06, 2026 - 06:21 vuln.today

DescriptionCVE.org

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /apartment-visitor/visitor-entry.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows authenticated remote attackers to manipulate backend database queries via the visname parameter in /apartment-visitor/visitor-entry.php. The flaw, classified as CWE-89, yields partial confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit exists on GitHub, lowering the skill bar for exploitation, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

CodeAstro Apartment Visitor Management System is a PHP-based web application for tracking building visitors, identified via CPE cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from the visname POST or GET parameter is concatenated directly into a SQL query without parameterization or adequate sanitization. The affected endpoint is /apartment-visitor/visitor-entry.php, which processes visitor registration or lookup. This class of flaw in PHP applications typically arises from use of deprecated mysql_query() calls or raw PDO/MySQLi without prepared statements, enabling classic in-band or error-based SQL injection techniques.

RemediationAI

No vendor-released patch has been identified at time of analysis - the CPE wildcard and absence of a vendor advisory with a fixed version confirm this. The primary remediation is to replace any raw SQL string concatenation in visitor-entry.php with parameterized queries using PHP PDO prepared statements or MySQLi prepared statements, which fully neutralizes CWE-89. As a compensating control, deploying a Web Application Firewall (WAF) with SQLi ruleset (e.g., ModSecurity with OWASP CRS) can detect and block common injection payloads with trade-off of potential false positives on legitimate input. Input validation on the visname parameter (allowlisting expected character sets such as alphanumeric plus limited punctuation) can reduce the attack surface but is not a complete fix - application-layer sanitization alone is insufficient as a primary control. Restrict database user privileges to least-privilege for the application account to limit what an attacker can extract or modify post-exploitation. Monitor VulDB at https://vuldb.com/vuln/376392 and the vendor site https://codeastro.com/ for patch releases.