PT-2026-33817 · Unknown · Apartment Visitor Management System

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-39110

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apartment Visitors Management System version 1.1

Description An issue exists in the forgot password page 'forgot-password.php' where the contactno parameter is susceptible to SQL Injection. This allows an unauthenticated attacker to manipulate backend SQL queries during authentication to retrieve sensitive database contents.

Recommendations Update Apartment Visitors Management System version 1.1 to a patched version. As a temporary workaround, restrict access to the 'forgot-password.php' page or avoid using the contactno parameter until a fix is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39110

Affected Products

Apartment Visitor Management System

References · 5

• 🔥 https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39110 · Security Note
• https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql · Note
• https://phpgurukul.com/?sdm_process_download=1&download_id=21524 · Note
• https://twitter.com/CVEnew/status/2046601525275881693 · Twitter Post