PatchSiren cyber security CVE debrief
CVE-2026-10262 code-projects CVE debrief
A SQL injection vulnerability exists in the code-projects Real State Services 1.0 application, specifically within the /loginuser.php file's Login component. The Username parameter is susceptible to manipulation, allowing remote attackers to inject malicious SQL commands. The vulnerability has been publicly disclosed and proof-of-concept exploit information is available. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no required privileges, and no user interaction needed, with low impacts to confidentiality, integrity, and availability. The vulnerability is mapped to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (Improper Neutralization of Special Elements in an SQL Command).
- Vendor
- code-projects
- Product
- Real State Services
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Organizations running code-projects Real State Services 1.0, particularly those with externally accessible login interfaces. Security teams responsible for web application security, database administrators, and developers maintaining PHP-based real estate management applications.
Technical summary
The vulnerability resides in /loginuser.php within the Login component of code-projects Real State Services 1.0. The Username parameter lacks proper input validation and sanitization, permitting SQL injection attacks. The attack vector is network-based, requires no authentication or user interaction, and has low attack complexity. Successful exploitation may result in unauthorized data access, data modification, or potential authentication bypass. The CVSS 4.0 score of 5.5 reflects limited impacts to confidentiality, integrity, and availability.
Defensive priority
medium
Recommended defensive actions
- Review and validate all user-supplied input to the /loginuser.php Username parameter, implementing parameterized queries or prepared statements to prevent SQL injection
- Apply input sanitization and output encoding consistent with OWASP guidelines for SQL injection prevention
- Monitor web application logs for anomalous authentication attempts or SQL error messages that may indicate exploitation attempts
- Consider implementing a Web Application Firewall (WAF) with SQL injection detection rules as a compensating control until code-level fixes are deployed
- Restrict network access to the administrative login interface where feasible, applying principle of least privilege for authentication endpoints
Evidence notes
The vulnerability was reported through VulDB (submission 824877, vulnerability entry 367542). The CNA source is [email protected]. Vendor identification remains uncertain; the reference domain candidate suggests 'Code Projects' as the associated entity, but this requires review. The NVD status at time of publication was 'Received'.
Official resources
Public disclosure occurred on 2026-06-01. A GitHub issue containing exploit details has been published and is accessible. No known active exploitation in ransomware campaigns has been documented.