PT-2026-33818 · Unknown · Apartment Visitor Management System

Published 2026-04-20 · Updated 2026-04-22 · CVE-2026-39111

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apartment Visitors Management System version 1.1

Description An issue exists in the forgot password page 'forgot-password.php' where the email parameter is susceptible to SQL Injection. This allows an unauthenticated attacker to manipulate backend SQL queries and retrieve sensitive user data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-39111

Affected Products

Apartment Visitor Management System

References · 6

• 🔥 https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-39111 · Security Note
• https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql · Note
• https://twitter.com/CVEnew/status/2046601526198587517 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2046760311500222565 · Twitter Post
• https://phpgurukul.com/?sdm_process_download=1&download_id=21524 · Note