CVE-2026-14766

MEDIUM

CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection

Title source: cna

Description

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/search-result.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

References (6)

Core 6

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-376356 | CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection

https://vuldb.com/vuln/376356

Signature, Permissions Required signature permissions-required

VDB-376356 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/376356/cti

Third Party Advisory third-party-advisory

CVE-2026-14766 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-14766

Third Party Advisory third-party-advisory

Submit #850616 | Codeastro Apartment Visitor Management System V1.0 SQL Injection

https://vuldb.com/submit/850616

Exploit exploit

https://gist.github.com/menelausx/29aef0a0ab6f289c0f45b379f6d759d7

Product product

https://codeastro.com/

Scores

CVSS v3 6.3

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-74 CWE-89

Status published

Products (1)

CodeAstro/Apartment Visitor Management System 1.0

Published Jul 05, 2026

Tracked Since Jul 06, 2026