Is there a public PoC exploit available for CVE-2026-14769?

Yes, a public proof-of-concept exploit is available for CVE-2026-14769. Prioritise patching immediately. EPSS: 0.3%.

Real State Services CVE-2026-14769

Q: What is the CVSS score of CVE-2026-14769?

CVE-2026-14769 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41779 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-pvmm-x2wc-97cp

PHP SQLi Real State Services Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable with no auth or interaction required; partial C/I/A reflects limited but real read/write database exposure without full system compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 21:00 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such manipulation of the argument Bankname leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Real State Services 1.0 exposes the /pay.php endpoint to remote unauthenticated attackers who can manipulate the Bankname parameter to execute arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote reachability, though partial CIA impact scores indicate constrained blast radius rather than full database takeover; no public confirmation of active exploitation (CISA KEV) exists at time of analysis.

Technical ContextAI

Real State Services 1.0 is a PHP-based real estate web application distributed by code-projects. The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the Bankname POST parameter submitted to /pay.php is concatenated directly into a SQL query without parameterization, escaping, or use of PHP PDO/MySQLi prepared statements. The CPE cpe:2.3:a:code-projects:real_state_services:*:*:*:*:*:*:*:* uses a version wildcard, suggesting all releases are affected. The payment-processing context of /pay.php implies the vulnerable query likely touches transaction, user, or financial record tables, making data exposure particularly sensitive if the instance holds real user data.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive fix is to refactor /pay.php to use PHP PDO or MySQLi prepared statements with bound parameters for the Bankname input, eliminating unsanitized concatenation into SQL queries entirely. As an interim compensating control, deploying a WAF rule to block SQL metacharacter patterns (single quotes, UNION, comment sequences) in the Bankname POST parameter can reduce exploitation risk, though WAF rules carry bypass risk and do not address the root cause. Additionally, restricting network access to the /pay.php endpoint to trusted IP ranges or placing it behind authentication middleware would raise the attacker's prerequisite bar from zero to at least credential possession. All other user-supplied parameters in the application should be audited for the same CWE-89 pattern. Monitor https://vuldb.com/vuln/376359 for any vendor patch release.