EIP-2026-105191

This exploit demonstrates a time-based blind SQL injection vulnerability in the 'email' parameter of the Apartment Visitors Management System 1.0's forgot-password.php endpoint. The payload uses a SLEEP function to confirm the vulnerability, indicating a MySQL backend.