CVE-2026-14797 identifies a SQL injection vulnerability in CodeAstro Apartment Visitor Management System 1.0. The flaw exists in the handling of the 'editid' argument within the /apartment-visitor/edit-apartment.php script, enabling remote attackers to inject malicious SQL commands. This can lead to unauthorized database queries or modifications. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion within the affected system. The impact is rated as medium severity, reflecting limited but significant risk to data confidentiality and integrity. There are no reports of active exploitation in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users of CodeAstro Apartment Visitor Management System 1.0 should monitor vendor communications for updates. In the meantime, restricting access to the vulnerable endpoint and employing web application firewalls with SQL injection detection rules may help mitigate risk. Avoid exposing the application to untrusted networks until a fix is released.