Real State Services CVE-2026-14768

Q: What is the CVSS score of CVE-2026-14768?

CVE-2026-14768 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41778 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-xf57-64xg-r6jf

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-exploitable unauthenticated SQLi with no special conditions; impact rated Low on all axes consistent with the CVSS 4.0 source data and limited application scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 20:52 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file /builderHome.php. This manipulation of the argument loc causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 exposes the /builderHome.php endpoint to unauthenticated remote attackers who can manipulate database queries via the unsanitized loc parameter. A public proof-of-concept exploit exists (referenced via GitHub), lowering the exploitation barrier to script-kiddie level. No KEV listing exists, and the product's limited real-world deployment constrains overall population risk despite the trivial attack conditions.

Technical ContextAI

The affected product is a PHP-based real estate demo/student application distributed by code-projects.org. The root cause maps to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), the parent class covering SQL injection, where the loc parameter accepted by /builderHome.php is passed directly to a backend SQL query without sanitization or parameterization. No CPE string was provided in the intelligence data, but the product is confirmed as version 1.0. The typical technology stack for code-projects.org applications is PHP with MySQL, where failure to use prepared statements or input validation yields straightforward, exploitable injection points. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special attack requirements beyond network connectivity.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Real State Services 1.0. Developers should immediately refactor the loc parameter handling in /builderHome.php to use parameterized queries or PDO prepared statements, eliminating the injection point entirely. As an interim compensating control, restrict public access to /builderHome.php via web server configuration (e.g., an Apache .htaccess deny rule or an nginx location block returning 403) - note this disables the affected page functionality. A web application firewall rule targeting common SQL injection patterns in the loc parameter can provide partial mitigation but should not be treated as a permanent fix. The vulnerability report is documented at https://vuldb.com/vuln/376358 and the POC is available at https://github.com/6Justdododo6/CVE/issues/27 for developer reference.