A weakness has been identified in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipul…

A SQL injection vulnerability has been identified in code-projects Real State Services 1.0, specifically in the /single-list_rent.php file. The vulnerability is triggered by manipulating the 'ID' argument, allowing an attacker to execute arbitrary SQL queries. The attack can be launched remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The affected product is a real estate web application built on PHP. The vulnerability has been assigned CVE-2026-14745 and is tracked on multiple security databases including NVD and VulDB. No patch or mitigation details are mentioned in the article. The public availability of the exploit makes this a high-priority issue for users running this software.