A weakness has been identified in code-projects Real State Services 1.0. This vulnerability affects unknown code of the file /builderHome.php. This manipulation…

A SQL injection vulnerability has been identified in code-projects Real State Services 1.0, specifically in the file /builderHome.php. The vulnerability is triggered by manipulating the 'loc' argument, allowing an attacker to perform SQL injection attacks. The attack can be carried out remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The affected product is a real estate services web application. The vulnerability is tracked as CVE-2026-14768 and has been reported via VulDB and GitHub. No authentication requirements are mentioned, suggesting the attack surface may be broad. Organizations using this software should apply patches or mitigations immediately.