The vulnerability is a classic SQL injection flaw located in the username field of the login page of Apartment Visitors Management System, version 1.1. An attacker who does not need to authenticate can supply specially crafted input that alters the SQL query executed by the backend. This manipulation can lead to extraction of sensitive data from the database, such as user records, contact information, and potentially other confidential details stored by the application. The flaw is based on CWE‑89.

The affected product is Apartment Visitors Management System version 1.1. No other vendors or versions are listed, so the scope is limited to installations running this specific version of the system.

The CVSS score of 9.4 indicates a high severity, and the CVE has no publicly disclosed EPSS score and is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed to date. However, because the flaw is unauthenticated and is triggered by a simple HTTP request to the login endpoint, its potential for exploitation is high. Attackers can discover the vulnerability by scanning for the login page and submitting crafted input. If leveraged, the impact is data theft and database compromise, but the CVE does not indicate a direct code execution or denial‑of‑service path.