PT-2026-55820

CVE-2026-14768

Published

2026-07-05

Updated

2026-07-06

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions code-projects Real State Services version 1.0

Description An issue exists in the /builderHome.php file where improper handling of the loc variable allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database.

Recommendations Update code-projects Real State Services version 1.0 to a patched version. As a temporary workaround, restrict access to the /builderHome.php file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Xuyue

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers