CVE-2026-78244: SQL Injection in itsourcecode Real Estate Management System
Description
CVE-2026-78244 is a SQL injection vulnerability in itsourcecode Real Estate Management System version 1.0. The flaw exists in the search.php file, where manipulation of parameters such as search, delivery_type, search_price, or property_type can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVSS v4.0
Score 6.9medium
Affected software
itsourcecode
Real Estate Management System
pkg:github/itsourcecode/real_estate_management_systemcpe:2.3:a:itsourcecode:real_estate_management_system:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-78244 affects itsourcecode Real Estate Management System 1.0. It is a SQL injection issue in the search.php file triggered by manipulating certain input parameters (search, delivery_type, search_price, property_type). This allows an unauthenticated remote attacker to inject SQL commands. The vulnerability has been publicly disclosed and exploit code is available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low to low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS 4.0 score of 6.9. No information about active exploitation in the wild is reported.
Mitigation Recommendations
No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable functionality if possible and monitor for suspicious activity related to the affected parameters.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-24T05:18:47.497Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8c261eacd9273b496b635f
Added to database: 08/24/2026, 11:08:14 UTC
Last enriched: 09/10/2026, 22:47:53 UTC
Last updated: 10/08/2026, 06:48:19 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.