Quick answers
- Is CVE-2026-77020 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77020 being exploited in the wild.
- How severe is CVE-2026-77020?
- High severity, with a CVSS score of 7.3, published 20 August 2026.
- Which products and versions are affected?
- CodeAstro Apartment Visitor Management System 1.0.
- Is there a fix for CVE-2026-77020?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77020 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77020?
- Check whether you run CodeAstro Apartment Visitor Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A SQL injection vulnerability exists in the password-recovery.php file where the 'email' parameter is concatenated directly into SQL queries without proper input validation, sanitization, or prepared statements. An unauthenticated attacker can send a crafted POST request with malicious SQL payloads in the email parameter to manipulate query logic, including time-based blind SQL injection techniques for data exfiltration. The vulnerability allows complete database compromise, including unauthorized access to sensitive information, data manipulation, and potential remote code execution depending on database permissions. Patching requires implementation of prepared statements with parameterized queries, strict input validation, and application of principle of least privilege to database accounts.
Affected products
- CodeAstro Apartment Visitor Management System 1.0
Timeline
- 2026-07-05: disclosed: Vulnerability reported on GitHub
- 2026-08-20: advisory: CVE-2026-77020 published