CVE-2026-14769
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely inject SQL queries, potentially leading to unauthorized database access, data leakage, or data modification.
Recommendation
Immediately update the application to the latest version or apply a security patch. Additionally, implement input validation and parameterized SQL queries.
Other vulnerabilities in code-projects Real State Services
See all- CVE-2026-14746High
A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14744High
A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
Original NVD description (English source)
A security vulnerability has been detected in code-projects Real State Services 1.0. This issue affects some unknown processing of the file /pay.php. Such manipulation of the argument Bankname leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.