The vulnerability CVE-2026-14747 affects code-projects Real State Services version 1.0. It is an SQL injection flaw in an unspecified functionality within the /addprojectsale.php script. The injection point is the 'amen' argument, which can be manipulated by an attacker to inject SQL commands. The vulnerability allows remote attackers to execute unauthorized SQL queries. The CVSS 4.0 base score is 6.9, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has low impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication. This may lead to unauthorized data access or modification. However, the impact on confidentiality, integrity, and availability is rated as low according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, consider applying input validation or web application firewall rules to detect and block malicious input targeting the 'amen' parameter in /addprojectsale.php.