Is there a public PoC exploit available for CVE-2026-14746?

Yes, a public proof-of-concept exploit is available for CVE-2026-14746. Prioritise patching immediately. EPSS: 0.3%.

Real State Services CVE-2026-14746

Q: What is the CVSS score of CVE-2026-14746?

CVE-2026-14746 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41751 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-35w2-gj48-j2p3

PHP SQLi Real State Services Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

SQL injection with no auth (PR:N, AV:N) enables full database read (C:H) and write/delete (I:H); availability impact is partial, not total.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 12:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 12:17 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectrent.php. The manipulation of the argument amen leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the backend database via the amen parameter in /addprojectrent.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no attack preconditions. A publicly available proof-of-concept exploit has been disclosed via GitHub, elevating the realistic threat beyond theoretical; however, this CVE is not currently listed in the CISA KEV catalog, and the product's limited enterprise footprint constrains broad impact.

Technical ContextAI

Real State Services 1.0 is a PHP-based web application from code-projects (cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:*), a vendor known for distributing educational and small-scale PHP project templates. The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from the amen HTTP parameter in the /addprojectrent.php endpoint is concatenated directly into a SQL query without sanitization or use of parameterized statements. This is a classic first-order SQL injection pattern common in legacy PHP applications that use procedural database calls (e.g., mysqli_query with unsanitized GET/POST input). The affected CPE wildcard (* version field) suggests NVD has not bounded the vulnerability to a specific patch version, implying the entire 1.0 codebase is affected.

RemediationAI

No vendor-released patch has been identified at time of analysis; code-projects does not appear to maintain a formal security advisory channel. The primary remediation is to replace direct SQL string concatenation in /addprojectrent.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi prepared statements), which eliminates the injection surface entirely. As an immediate compensating control, restrict access to the /addprojectrent.php endpoint at the web server or firewall layer to trusted IP ranges only - note this may break legitimate functionality for remote users. A web application firewall (WAF) rule targeting common SQL injection payloads in the amen parameter can reduce automated exploitation risk but should not be treated as a full fix, as WAF rules can be bypassed. Input validation (allowlisting expected amen values) provides defense-in-depth but is secondary to parameterization. Reference the public POC at https://github.com/6Justdododo6/CVE/issues/25 to understand specific payload patterns when testing mitigations. If the application is not in active use, decommission and remove it from public-facing infrastructure.