Description
A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-08-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the CodeAstro Apartment Visitor Management System allows an attacker to inject arbitrary SQL statements through the secode parameter in forgotpw.php. The vulnerability results in a SQL injection that can let a remote attacker retrieve, modify, or delete data stored in the application database. The weakness is classified as CWE-74 and CWE-89, indicating improper handling of string data and lack of parameterized queries.

Affected Systems

The affected product is CodeAstro Apartment Visitor Management System 1.0. The vulnerability is located in the forgotpw.php functionality that processes the secode argument; no other product versions have been reported as affected.

Risk and Exploitability

The CVSS base score is 6.9, indicating significant impact yet not critical. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. An attacker can trigger the flaw remotely by sending a crafted request to the forgotpw.php endpoint, and the exploit has already been publicly disclosed.

Generated by OpenCVE AI on August 20, 2026 at 20:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Review the vendor’s site, download, and apply any available patch that addresses the SQL injection flaw for the Apartment Visitor Management System.
  • If a patch cannot be applied immediately, limit access to /apartment-visitor/forgotpw.php to trusted IP ranges or administrator users.
  • Implement robust input validation and sanitization for the secode parameter, ensuring that only expected values are accepted before they are used in SQL queries.

Generated by OpenCVE AI on August 20, 2026 at 20:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Title CodeAstro Apartment Visitor Management System forgotpw.php sql injection
First Time appeared Codeastro
Codeastro apartment Visitor Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:codeastro:apartment_visitor_management_system:*:*:*:*:*:*:*:*
Vendors & Products Codeastro
Codeastro apartment Visitor Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Codeastro Apartment Visitor Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T16:15:09.116Z

Reserved: 2026-08-20T08:29:52.085Z

Link: CVE-2026-77019

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T17:19:49.063

Modified: 2026-08-20T17:19:49.063

Link: CVE-2026-77019

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')