PT-2026-33816 · Unknown · Apartment Visitor Management System

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-39109

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apartment Visitors Management System version 1.1

Description An issue exists in the login page 'index.php' where the username parameter is susceptible to SQL Injection. This allows an unauthenticated attacker to manipulate backend SQL queries during the authentication process to retrieve sensitive database contents.

Recommendations Update Apartment Visitors Management System to a version newer than 1.1. As a temporary workaround, restrict access to the 'index.php' page or sanitize the username parameter to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39109

Affected Products

Apartment Visitor Management System

References · 5

• 🔥 https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39109 · Security Note
• https://phpgurukul.com/?sdm_process_download=1&download_id=21524 · Note
• https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql · Note
• https://twitter.com/CVEnew/status/2046601524306964789 · Twitter Post