Real State Services CVE-2026-14747

Q: What is the CVSS score of CVE-2026-14747?

CVE-2026-14747 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41752 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-rr2j-63gw-g4xf

PHP SQLi Real State Services Code Projects

6.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable with no authentication or interaction required; impact capped at Low across all dimensions consistent with partial SQL data access rather than full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 13:01 vuln.today

DescriptionCVE.org

A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the file /addprojectsale.php. The manipulation of the argument amen results in sql injection. The attack can be launched remotely.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 exposes the application's database to remote unauthenticated manipulation via the amen parameter in /addprojectsale.php. Any attacker with network access to the PHP web application can craft a malicious HTTP request to read, modify, or partially disrupt the underlying database without authentication. No active exploitation is confirmed in CISA KEV, but a GitHub issue filed under the researcher's CVE repository suggests reproduction steps or proof-of-concept detail is publicly accessible.

Technical ContextAI

Real State Services is a PHP-based real estate management script distributed by code-projects.org, a small commercial PHP project marketplace. The affected file /addprojectsale.php handles property sale record creation and passes the amen parameter (likely representing an amenity field) directly into a SQL query without sanitization or parameterization - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect. The CPE string cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:* covers all versions, though version 1.0 is the confirmed affected release. The root cause is absence of prepared statements or input escaping in the PHP data access layer.

RemediationAI

No vendor-released patch has been identified at the time of analysis. The primary fix requires modifying /addprojectsale.php to use PHP PDO or MySQLi prepared statements for the amen parameter, replacing any direct string interpolation into SQL queries. As an immediate compensating control, operators should restrict public network access to /addprojectsale.php via web server access controls (e.g., Apache Require ip or nginx allow/deny directives) if the endpoint does not need to be publicly exposed - this eliminates the network attack surface at the cost of restricting legitimate remote use. Deploying a WAF rule blocking common SQL injection patterns (single quotes, UNION SELECT, comment sequences) on this endpoint provides an additional layer but is bypassable by sufficiently obfuscated payloads. Operators should also review database user privileges and ensure the application's DB account has minimal permissions (SELECT/INSERT only, no DROP/FILE). The vendor project page at https://code-projects.org/ should be monitored for any patch release.