CVE-2026-14795 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System 1.0. The vulnerability exists due to insufficient input validation or sanitization of the 'remark' argument in the /apartment-visitor/action-visitor.php script. This flaw allows remote attackers with low privileges to inject malicious SQL code, potentially impacting the confidentiality, integrity, and availability of the system's data. The vulnerability has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or denial of service. The vulnerability requires no user interaction and can be exploited remotely with low attack complexity and no privileges required beyond low-level access. The overall impact is rated medium based on the CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'remark' parameter to prevent SQL injection. Restrict database permissions to minimize potential damage from exploitation. Monitor for any vendor updates or patches addressing this vulnerability.