Real State Services CVE-2026-10262

Q: What is the CVSS score of CVE-2026-10262?

CVE-2026-10262 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33644 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 cna@vuldb.com

GHSA-2h9g-8p3q-w23q

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 15:37 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Real State Services 1.0. This impacts an unknown function of the file /loginuser.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unauthenticated SQL injection in code-projects Real State Services 1.0 exposes the login endpoint to remote database manipulation. The Username parameter passed to /loginuser.php is unsanitized and directly interpolated into SQL queries (CWE-74), enabling unauthenticated remote attackers to extract data, bypass authentication, or alter database contents. Exploit code has been publicly disclosed via a GitHub issue report, elevating practical risk despite the moderate CVSS 4.0 score of 5.5.

Technical ContextAI

Real State Services 1.0 is a PHP-based web application distributed by code-projects.org. The vulnerability resides in /loginuser.php, which processes the Username field from the login form. CWE-74 (Injection) identifies the root cause as unsanitized user-controlled input being incorporated into a backend SQL query without the use of parameterized statements or prepared queries - a foundational PHP coding error. The absence of input validation at this authentication boundary means the SQL interpreter receives attacker-controlled syntax, enabling classic SQLi techniques such as tautology-based authentication bypass (e.g., ' OR '1'='1) or UNION-based data extraction. No CPE string was provided in the source data, but the affected component is unambiguously identified as version 1.0 of this specific application.

RemediationAI

No vendor-released patch has been identified at time of analysis - absence of patch data in the source intelligence and no vendor advisory referencing a fixed version were found. The primary remediation is to refactor /loginuser.php to use parameterized SQL queries or prepared statements via PHP's PDO or MySQLi extensions, which eliminates the injection surface entirely. As a compensating control, operators should deploy a Web Application Firewall (WAF) with SQLi ruleset (e.g., OWASP ModSecurity Core Rule Set) in front of the login endpoint to block common injection payloads; note this is bypassable by advanced techniques and is not a substitute for code-level fixes. Additionally, restrict public internet access to the login page via IP allowlisting if the application serves a known user base, reducing exposure to opportunistic scanning. Input validation (allowlist on the Username field to alphanumeric characters) adds a shallow but low-cost additional layer. Reference: https://vuldb.com/vuln/367542 and https://github.com/6Justdododo6/CVE/issues/20 for exploit details to inform WAF rule tuning.