Is there a public PoC exploit available for CVE-2026-14744?

Yes, a public proof-of-concept exploit is available for CVE-2026-14744. Prioritise patching immediately. EPSS: 0.3%.

Real State Services CVE-2026-14744

Q: What is the CVSS score of CVE-2026-14744?

CVE-2026-14744 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41749 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-qq4w-wrrf-6p28

PHP SQLi Real State Services Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable, unauthenticated endpoint with no prerequisites; scope unchanged and low CIA impact reflects bounded database access without confirmed privilege escalation path.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 12:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 11:51 vuln.today

DescriptionCVE.org

A security flaw has been discovered in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.php. Performing a manipulation of the argument loc results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 exposes unauthenticated remote attackers a direct path to manipulate the backend database via the loc parameter in /normalHomeRent.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special configuration are required against default deployments. A public proof-of-concept exploit has been released on GitHub, materially increasing opportunistic exploitation risk despite the moderate aggregate score; no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Real State Services 1.0 is a PHP-based property rental web application distributed by code-projects.org (CPE: cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:*). The flaw is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the classic consequence of concatenating unsanitized user input directly into SQL query strings rather than using parameterized queries or prepared statements. The vulnerable endpoint /normalHomeRent.php processes the loc argument - likely a location or filter field - without adequate input sanitization, allowing an attacker to inject arbitrary SQL clauses. PHP applications of this type commonly use MySQLi or PDO without prepared statements in legacy or tutorial-grade codebases, making this pattern expected but fully preventable.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix requires a code-level change: replace direct string concatenation in the SQL query handling the loc parameter in /normalHomeRent.php with parameterized queries using PHP's PDO or MySQLi prepared statements, which structurally prevents injection regardless of input content. As an immediate compensating control, operators should deploy a Web Application Firewall rule to detect and block SQL metacharacters (single quotes, UNION, SELECT, comment sequences) in the loc parameter - note this may produce false positives for legitimate location names containing apostrophes. Additionally, restrict the application's database user to the minimum required privileges (SELECT only on required tables, no FILE or SUPER grants) to limit the blast radius of any successful injection. If the application is not required to be publicly internet-facing, restrict network access at the perimeter. Reference VulDB disclosure https://vuldb.com/vuln/376330 and exploit details at https://github.com/6Justdododo6/CVE/issues/23 for reproduction context.