CVE-2026-14746
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The organization is at risk of unauthorized database access, which could lead to sensitive data leakage, data modification or deletion, and potential system compromise.
Recommendation
Immediately update the application to the latest version or apply a security patch. In the meantime, implement input validation and sanitization for all user inputs, especially in the /addprojectrent.php file.
Other vulnerabilities in code-projects Real State Services
See all- CVE-2026-14769High
A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14744High
A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectrent.php. The manipulation of the argument amen leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.