CVE-2026-14796 is a SQL injection vulnerability affecting CodeAstro Apartment Visitor Management System 1.0. The issue exists in an unspecified part of the /apartment-visitor/report.php file, where the 'fromdate' argument is not properly sanitized, allowing remote attackers to inject SQL code. The vulnerability has been publicly disclosed, but no vendor-provided patch or official remediation is confirmed. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the impact is rated as medium, indicating limited confidentiality, integrity, and availability consequences. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation or web application firewall rules to filter or block malicious input targeting the 'fromdate' parameter. Monitoring for unusual database activity related to this parameter is also advisable.