CVE-2026-14796 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System version 1.0. The issue is located in the /apartment-visitor/report.php file where the 'fromdate' argument can be manipulated to inject SQL commands. This vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been documented, and the vendor has not provided remediation details. Public exploit code exists, but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, the impact is rated medium due to limited scope and complexity factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the 'fromdate' parameter to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.