Is there a public PoC exploit available for CVE-2026-14745?

Yes, a public proof-of-concept exploit is available for CVE-2026-14745. Prioritise patching immediately. EPSS: 0.3%.

Real State Services CVE-2026-14745

Q: What is the CVSS score of CVE-2026-14745?

CVE-2026-14745 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41750 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-m6mh-43x3-xc3j

PHP SQLi Real State Services Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable endpoint requires no authentication or interaction; SQL injection yields partial data read and write within the application's database scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 12:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 12:16 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the id parameter of /single-list_rent.php to read, modify, or corrupt backend database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction unauthenticated network exploitation against a standard installation. A public proof-of-concept exploit is available on GitHub (E:P confirmed in CVSS 4.0 supplemental metrics), raising realistic risk of opportunistic automated attacks against any internet-exposed instance; no CISA KEV listing and no patch are confirmed at time of analysis.

Technical ContextAI

Real State Services 1.0 is a PHP-based rental property listing web application distributed by code-projects.org. The vulnerability exists in /single-list_rent.php, a PHP script that accepts a user-supplied id parameter - almost certainly a database record identifier - and passes it directly into a SQL query without parameterization or sanitization, satisfying CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE string cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:* uses a full version wildcard, indicating NVD has not bounded the vulnerability to a specific version range beyond the reported 1.0. Classic PHP applications of this type typically use mysql_query() or mysqli_query() with inline string concatenation rather than prepared statements, which is the structural root cause for CWE-89.

RemediationAI

No vendor-released patch has been identified at the time of analysis. The definitive fix is to refactor /single-list_rent.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters) for all SQL operations involving the id parameter, eliminating the injection vector at the root. As an immediate compensating control, enforce strict integer-only input validation on the id parameter - rejecting any non-numeric input at the application or web-server level - which has minimal side effects for a record-lookup parameter. Deploying a WAF rule to block SQL metacharacter sequences in query parameters provides an additional layer but is bypassable and should not be treated as a permanent fix. If the rental listing page does not require unauthenticated public access, restricting it behind authentication middleware or network access controls would negate the network-reachable, no-auth attack vector entirely. Reference the public POC at https://github.com/6Justdododo6/CVE/issues/24 and the VulDB advisory at https://vuldb.com/vuln/376331 for technical reproduction details to validate any fix applied.