Quick answers
- Is CVE-2026-77019 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77019 being exploited in the wild.
- How severe is CVE-2026-77019?
- High severity, with a CVSS score of 7.3, published 20 August 2026.
- Which products and versions are affected?
- CodeAstro Apartment Visitor Management System 1.0.
- Is there a fix for CVE-2026-77019?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77019 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77019?
- Check whether you run CodeAstro Apartment Visitor Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SQL injection flaw in the /apartment-visitor/forgotpw.php file, specifically in the 'secode' parameter, which is processed without proper input validation or parameterized queries. An unauthenticated remote attacker can inject malicious SQL code through POST requests to manipulate database operations. The vulnerability allows time-based blind SQL injection attacks (confirmed via sqlmap testing with SLEEP() payloads), enabling database reconnaissance, data exfiltration, modification, or deletion. No vendor patch information is currently available; remediation requires implementation of prepared statements, input validation, and least-privilege database accounts.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-07-05: disclosed: Vulnerability reported on GitHub
- 2026-08-20: advisory: CVE-2026-77019 published by NVD