CVE-2026-14766 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System version 1.0. The issue exists in the handling of the 'searchdata' POST parameter within the /apartment-visitor/search-result.php component. An attacker can remotely exploit this flaw by injecting malicious SQL code through this parameter, potentially leading to unauthorized database access or manipulation. The vulnerability is publicly known, but no vendor-provided fix or mitigation has been published as of now.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data disclosure, data modification, or other database-related impacts depending on the database privileges of the application. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint, applying web application firewall (WAF) rules to detect and block SQL injection attempts, and reviewing application input validation and sanitization practices for the 'searchdata' parameter.