Is there a public PoC exploit available for CVE-2026-14743?

Yes, a public proof-of-concept exploit is available for CVE-2026-14743. Prioritise patching immediately. EPSS: 0.3%.

Real State Services CVE-2026-14743

Q: What is the CVSS score of CVE-2026-14743?

CVE-2026-14743 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41748 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-8w49-qm87-g3m9

PHP SQLi Real State Services Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated endpoint with no complexity; limited CIA impact (L/L/L) as scope is confined to the application database with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 12:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 11:52 vuln.today

DescriptionCVE.org

A vulnerability was identified in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeSale.php. Such manipulation of the argument loc leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 exposes the /normalHomeSale.php endpoint to unauthenticated remote database manipulation via the unsanitized loc parameter. Any internet-accessible deployment of this PHP real estate application is vulnerable to data extraction or modification without credentials. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for opportunistic attackers; however, no CISA KEV listing has been issued and no patch has been identified from the vendor.

Technical ContextAI

Real State Services is a PHP-based real estate web application distributed by code-projects.org as a downloadable source-code project. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied input to the loc argument in /normalHomeSale.php is concatenated directly into a backend SQL query without parameterization or escaping. The CPE string cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:* uses a wildcard version, indicating all tracked releases share this flaw. The attack surface is a standard HTTP GET or POST request to a publicly routable PHP endpoint backed by a relational database, consistent with classic LAMP-stack injection patterns.

RemediationAI

No vendor-released patch has been identified at time of analysis; the code-projects.org distribution model does not include a formal patch channel. The primary remediation for any deployment is to rewrite the vulnerable query in /normalHomeSale.php to use parameterized statements or prepared queries (PDO or MySQLi with bound parameters), eliminating the injection surface entirely. As an immediate compensating control, deployers should restrict access to /normalHomeSale.php via web server ACLs or firewall rules to trusted IP ranges, accepting the trade-off of reduced functionality for untrusted users. Deploying a web application firewall rule targeting SQL metacharacter patterns in the loc parameter can reduce opportunistic exploitation but will not stop targeted attacks using encoding evasion. Given the absence of a vendor fix, organizations should evaluate whether this application can be replaced with a patched fork or discontinued entirely. References: VulDB entry at https://vuldb.com/vuln/376329 and the POC at https://github.com/6Justdododo6/CVE/issues/22.