CVE-2026-39111

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-39111", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-20T18:12:54.038Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-04-20T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-20T17:20:13.092Z"}, "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php). This allows an unauthenticated attacker to manipulate backend SQL queries and retrieve sensitive user data."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/"}, {"url": "https://phpgurukul.com/?sdm_process_download=1&download_id=21524"}, {"url": "https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T18:12:39.812723Z", "id": "CVE-2026-39111", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T18:12:54.038Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39111", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T18:12:39.812723Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T18:12:27.665Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/"}, {"url": "https://phpgurukul.com/?sdm_process_download=1&download_id=21524"}, {"url": "https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/"}], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php). This allows an unauthenticated attacker to manipulate backend SQL queries and retrieve sensitive user data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-20T17:20:13.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39111", "state": "PUBLISHED", "dateUpdated": "2026-04-20T18:12:54.038Z", "dateReserved": "2026-04-06T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-20T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password page (forgot-password.php). This allows an unauthenticated attacker to manipulate backend SQL queries and retrieve sensitive user data."}], "id": "CVE-2026-39111", "lastModified": "2026-06-17T10:41:51.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39111", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T18:12:39.812723Z", "version": "2.0.3"}}]}, "published": "2026-04-20T18:16:27.263", "references": [{"source": "cve@mitre.org", "url": "https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/"}, {"source": "cve@mitre.org", "url": "https://phpgurukul.com/?sdm_process_download=1&download_id=21524"}, {"source": "cve@mitre.org", "url": "https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "apartment_visitors_management_system", "vendor": "phpgurukul"}], "analysis": {"en": {"generated_at": "2026-04-21T00:05:08.623973+00:00", "value": {"mitigation_remediation": ["Upgrade the application to a patched release that addresses the SQL injection flaw. If no patch is available, replace the email input handling in forgot-password.php with prepared statements or a proper escaping routine.", "Implement input validation rules that reject or sanitize any SQL meta\u2011characters before passing the value to the database.", "Configure a web application firewall or intrusion detection system to detect and block SQL injection attempts targeting the forgot\u2011password.php endpoint."], "summary": {"action": "Immediate Patch", "impact": "Data Disclosure via SQL Injection"}, "threat_synthesis": {"affected_systems": "The affected product is Apartment Visitors Management System version 1.1, a PHP/MySQL web application used for managing visitor access to apartment complexes. No vendor is listed, but the codebase is publicly available in GitHub repositories linked in the references. It appears to be a typical small\u2011scale application deployed on a web server with a MySQL database.", "description_and_impact": "The vulnerability is a classic SQL injection flaw located in the email parameter of the forgot password page of the Apartment Visitors Management System V1.1. An attacker can insert malicious SQL code into that field, which the application passes directly to the database without validation or parameterization. This allows the attacker to read or modify sensitive data stored in the backend MySQL database, potentially exposing user credentials, personal information, or other confidential records. The weakness is a direct injection of untrusted input into a SQL statement, identified as a standard SQL Injection vulnerability.", "risk_and_exploitability": "The CVE has a CVSS score of 7.5, indicating elevated severity. SQL injection is universally considered a high\u2011risk flaw because it permits unauthenticated attackers to extract or manipulate arbitrary data from the database. Attackers can trigger the flaw remotely by sending a crafted request to the forgot\u2011password.php page, so the vulnerability is exploitable over the network by anyone who can reach the web server. As it is not listed in the CISA KEV catalog, there is no evidence of active exploitation in the wild at the time of this analysis, but the combination of remote reachability and high information\u2011leak potential warrants immediate remediation."}}}}, "created": "2026-04-21T00:15:16.117969+00:00", "title": "SQL Injection Vulnerability in Apartment Visitors Management System Forgot Password Page", "updated": "2026-04-27T20:21:15.036621+00:00", "vendors": ["phpgurukul", "phpgurukul$PRODUCT$apartment_visitors_management_system"]}