CVE-2026-39109
CRITICALApartment Visitors Management System 1.1 - SQL Injection
Title source: llmDescription
SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve sensitive database contents.
Scores
CVSS v3
9.4
EPSS
0.0017
EPSS Percentile
38.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Details
CWE
CWE-89
Status
published
Published
Apr 20, 2026
Tracked Since
Apr 20, 2026