Description
A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Published: 2026-07-04
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in CodeAstro Apartment Visitor Management System, located in the Username field of the /index.php login page, allows injection of arbitrary SQL commands. This is a SQL injection. According to the CVE description, this injection can be triggered from a remote network and a public exploit confirms that the flaw is usable by attackers.

Affected Systems

The vulnerability affects CodeAstro’s Apartment Visitor Management System version Login component accessed through /index.php. No other versions or configurations are currently identified as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity while the EPSS score of <1% suggests a very low probability of exploitation, though still non-zero. The issue is not listed in CISA’s KEV catalog, and the provided description indicates that the attack can be performed over the network without any special privileges being required.

Generated by OpenCVE AI on July 26, 2026 at 21:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and install any available official patch or updated release from CodeAstro that corrects the SQL injection in the login component
  • Modify the login logic to use parameterized queries or prepared statements so that user-suppliedforce strict input validation on the Username field, such as allowing only expected alphanumeric characters or using a whitelist approach
  • Deploy a web application firewall or similar controls to detect and block SQL injection patterns targeting the /index.php endpoint

Generated by OpenCVE AI on July 26, 2026 at 21:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Title CodeAstro Apartment Visitor Management System Login index.php sql injection
First Time appeared Codeastro
Codeastro apartment Visitor Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*
Vendors & Products Codeastro
Codeastro apartment Visitor Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Codeastro Apartment Visitor Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:51:20.774Z

Reserved: 2026-07-03T17:29:12.063Z

Link: CVE-2026-14640

cve-icon Vulnrichment

Updated: 2026-07-06T16:46:06.776Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T22:00:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')