CVE-2026-14640 identifies a SQL injection vulnerability in CodeAstro Apartment Visitor Management System 1.0. The issue exists in an unspecified function within the /index.php file of the Login component, where manipulation of the Username parameter can lead to SQL injection. This allows an unauthenticated remote attacker to potentially interfere with backend database queries. The vulnerability has been publicly disclosed with exploit code available, but there is no vendor-provided fix or mitigation at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Username parameter. Additionally, review and harden input validation and parameterized query usage in the Login component if source code access is available.