Is there a public PoC exploit available for EUVD-2026-41808?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41808. Prioritise patching immediately. EPSS: 0.2%.

Apartment Visitor Management System EUVD-2026-41808

Q: What is the CVSS score of EUVD-2026-41808?

EUVD-2026-41808 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-14797 LOW

SQL Injection (CWE-89)

2026-07-06 VulDB

GHSA-mfm4-w88p-m39r

PHP SQLi Apartment Visitor Management System Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQLi requires a low-privilege authenticated session (PR:L); impact is partial read, write, and minor availability disruption on the database only, with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 06:22 vuln.today

Severity Changed

Jul 06, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. This vulnerability affects unknown code of the file /apartment-visitor/edit-apartment.php. Executing a manipulation of the argument editid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the application's database to remote authenticated attackers through the unsanitized editid parameter in /apartment-visitor/edit-apartment.php. Low-privilege authenticated users can manipulate this parameter to read, modify, or partially disrupt database contents. A public proof-of-concept exploit has been disclosed on GitHub (no public exploit identified in CISA KEV at time of analysis), making this a realistic risk for any internet-exposed deployment of this PHP application.

Technical ContextAI

CodeAstro Apartment Visitor Management System is a PHP-based web application for managing apartment visitor records, identified by CPE cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection resulting from direct interpolation of the editid GET/POST parameter into a backend SQL query within the edit-apartment.php script without parameterization or sanitization. This pattern is typical of legacy PHP applications that build queries via string concatenation rather than prepared statements. The wildcard version in the CPE string suggests the flaw may exist across all versions of the product, not solely 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to apply parameterized queries or prepared statements to the editid parameter in /apartment-visitor/edit-apartment.php, eliminating the SQL injection root cause. As a compensating control, operators should restrict access to the application to trusted internal networks or VPN, preventing unauthenticated network exposure and reducing the attacker pool to known users - this does not eliminate the vulnerability but raises the bar. Deploying a web application firewall (WAF) with SQL injection signatures (e.g., ModSecurity CRS rule set) can detect and block common SQLi payloads in transit, though determined attackers may bypass signature-based controls. Reducing database account privileges to the minimum required by the application limits the blast radius of a successful injection. Monitor VulDB (https://vuldb.com/vuln/376391) and CodeAstro's site (https://codeastro.com/) for patch availability.