The vulnerability CVE-2026-14746 affects code-projects Real State Services 1.0. It is a SQL injection flaw in an unspecified function in the /addprojectrent.php file. The attack vector is the 'amen' parameter, which when manipulated, allows an attacker to inject SQL commands remotely without any privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the application's database permissions. The medium severity reflects a moderate risk due to the ease of exploitation but limited impact scope as per CVSS metrics.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's communications for updates or patches. In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'amen' parameter in /addprojectrent.php. Avoid exposing the vulnerable endpoint to untrusted networks if possible.