The vulnerability CVE-2026-14798 affects CodeAstro Apartment Visitor Management System 1.0. It is caused by improper sanitization of the 'visname' argument in the /apartment-visitor/visitor-entry.php endpoint, which leads to SQL injection. This allows an attacker to remotely execute arbitrary SQL queries against the backend database. The CVSS 4.0 base score is 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official patch or vendor remediation level is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database and application context. The impact is rated as medium severity based on CVSS 4.0 scoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'visname' parameter. Code review and input validation/sanitization on the affected parameter are recommended as temporary mitigations.