CVE-2026-14744
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
Risk Assessment
The organization is at risk of sensitive data leakage, modification, or deletion from the database, as well as potential system compromise by the attacker.
Recommendation
Immediately apply a patch from the vendor or temporarily disable access to /normalHomeRent.php. Additionally, implement input validation and sanitization for all user inputs.
Other vulnerabilities in code-projects Real State Services
See all- CVE-2026-14769High
A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14746High
A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.php. Performing a manipulation of the argument loc results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.