CVE-2026-14795 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System version 1.0. The flaw exists in the handling of the 'remark' argument within the /apartment-visitor/action-visitor.php script, enabling remote attackers to inject SQL commands. The vulnerability is exploitable without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with limited impact on confidentiality, integrity, and availability according to the CVSS 4.0 metrics. There is no evidence of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should consider implementing temporary mitigations such as input validation and parameterized queries if possible. Monitor vendor communications for updates regarding an official patch or remediation.