CVE-2026-77020: SQL Injection in CodeAstro Apartment Visitor Management System

The vulnerability in CodeAstro Apartment Visitor Management System 1.0 involves SQL injection via the email argument in the password-recovery.php file. This allows an unauthenticated remote attacker to inject malicious SQL commands, potentially compromising the database. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges or user interaction required, but limited confidentiality, integrity, and availability impacts. Public exploit code exists, increasing risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. No evidence of active exploitation in the wild has been reported.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password-recovery.php functionality if possible and monitor for suspicious activity related to this endpoint.