CVE-2026-14689 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System version 1.0. The flaw exists in an unknown function within the /apartment-visitor/add-apartment.php file, where the apartmentno parameter is not properly sanitized. This allows remote attackers to inject arbitrary SQL commands, potentially compromising the backend database. The vulnerability has been publicly disclosed with exploit code available, but no official fix or mitigation has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity with a CVSS score of 5.3, indicating a moderate risk. There are no confirmed reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts.