A weakness has been identified in code-projects Real State Services 1

CVE-2026-13559 is a CWE-74 injection flaw (almost certainly SQL injection or reflected parameter injection given the C:L/I:L/A:L impact profile) in code-projects Real State Services 1.0 — one of the thousands of free, single-version PHP/MySQL learner projects published by *code-projects.org* and mirrored on sites like sourcecodester. Affected version is 1.0 only, which is also the only version that exists. There is no v1.1, no LTS branch, no vendor support, and no patch pipeline; the project is a static download.

The vendor (VulDB) severity of HIGH 7.3 is wildly out of step with reality. The CVSS vector is mechanically correct — a network-reachable, unauthenticated injection deserves those base metrics — but CVSS does not model installed base, and that's the whole story here. This codebase is used in classroom assignments and portfolio demos, not in production. Treating it like a HIGH-severity enterprise vulnerability is the textbook example of why CVSS without enrichment misallocates defender attention.

Why this verdict

• Installed-base share below noise floor: code-projects releases are tutorial artifacts. Shodan/FOFA show negligible internet presence; no enterprise CMDB will list this product.
• No high-value-role mapping: the affected component is not an IdP, hypervisor, PAM, backup server, CA, kernel-mode agent, or edge appliance. Deployment-role blast-radius floor is N/A — worst-case outcome is loss of a throwaway demo database.
• No vendor patch pipeline: there is no v1.1 to upgrade to, which paradoxically means defenders cannot 'patch' even if they wanted to — the only remediation is removal.
• Friction at step 1 is total: the attack assumes you find this app in production. In an enterprise fleet, you will not.
• No active exploitation, not KEV-listed, low EPSS expected — none of the upward-pressure indicators apply.

Why not higher?

A HIGH or even MEDIUM verdict would imply some realistic chance an enterprise defender finds this in their environment and faces meaningful impact. Both are false: the product is not enterprise software, and the impact ceiling is C:L/I:L/A:L on a single hobby app. CVSS base score does not capture exposure or deployment role, and both collapse the real risk to near zero.

Why not lower?

There is nothing lower than IGNORE in the scale. If a defender does discover this app running on shadow IT or a forgotten dev box, it should be removed, not catalogued as a backlog item — but that is an asset-hygiene issue, not a patch-management priority.

1. Confirm absence in CMDB and asset inventory — Search asset inventory, SBOMs, and web-app discovery scans for the strings code-projects, Real State Services, and the distinctive template assets. If zero hits — which is the expected outcome — close the ticket. No mitigation SLA applies at IGNORE.
2. Remove, don't patch, any instance you do find — If a rogue/shadow deployment surfaces (dev sandbox, intern project, abandoned demo box), decommission it. There is no upstream patch, so 'remediation' = removal. Treat as backlog hygiene with no SLA.
3. WAF generic SQLi/CRS rules on any residual deployment — If business reasons force you to keep an instance alive temporarily, front it with a WAF in blocking mode using OWASP CRS paranoia level 2+. This is a stopgap, not a fix.

Run on a discovery host or auditor workstation with access to your web inventory. Pipe a list of URLs into the script: ./check-real-state-services.sh urls.txt. No special privileges required — issues unauthenticated HTTP GETs only. Output is VULNERABLE (instance found), PATCHED (no instance found — this is the expected result), or UNKNOWN (host unreachable).

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13559
# Detects presence of code-projects Real State Services 1.0 instances.
# There is no patched version; *presence* equals exposure.
set -u

if [[ $# -lt 1 ]]; then
  echo "usage: $0 <urls-file>" >&2
  exit 64
fi

URLS_FILE="$1"
if [[ ! -r "$URLS_FILE" ]]; then
  echo "cannot read $URLS_FILE" >&2
  exit 66
fi

FOUND=0
UNREACHABLE=0
TOTAL=0

while IFS= read -r url; do
  [[ -z "$url" ]] && continue
  TOTAL=$((TOTAL+1))
  body=$(curl -sS --max-time 8 -L "$url" 2>/dev/null) || { UNREACHABLE=$((UNREACHABLE+1)); continue; }
  # Fingerprint strings typical of the code-projects template.
  if echo "$body" | grep -qiE 'real[ _-]?state[ _-]?services|code-projects|/admin/property|propertytype\.php'; then
    echo "VULNERABLE: $url (code-projects Real State Services fingerprint matched)"
    FOUND=$((FOUND+1))
  fi
done < "$URLS_FILE"

echo "---"
echo "scanned=$TOTAL unreachable=$UNREACHABLE matches=$FOUND"

if [[ $FOUND -gt 0 ]]; then
  exit 1   # VULNERABLE
elif [[ $UNREACHABLE -eq $TOTAL ]]; then
  echo "UNKNOWN"; exit 2
else
  echo "PATCHED"; exit 0
fi

Sources

1. NVD search portal
2. CISA Known Exploited Vulnerabilities Catalog
3. FIRST EPSS model
4. VulDB (typical broker for code-projects CVEs)
5. code-projects.org (vendor site)
6. CWE-74: Improper Neutralization of Special Elements in Output (Injection)
7. OWASP ModSecurity Core Rule Set
8. Shodan