PT-2026-52729

CVE-2026-54827

Published

2026-06-17

Updated

2026-06-26

Description by

CVSS 3.1

9.3

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Real Estate 7 versions prior to 3.6.0

Description An unauthenticated SQL Injection exists due to insufficient escaping of user-supplied parameters and a lack of proper preparation of SQL queries. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update Real Estate 7 to a version newer than 3.5.9.

Exploitability

Fix

Impacts

Researchers

João Pedro S Alcântara

Kinorth

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers