Medium severity · published Jan 30, 2026
CVE-2026-1700
projectworlds House Rental and Property Listing sms.php cross site scripting
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknown code of the file /app/sms.php. This manipulation of the argument Message causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
House Rental and Property Listing · projectworlds
1.0 · source: vendor
HR
House Rental And Property Listing Project · Projectworlds
1.0 · source: NVD
Affected product
HR
House Rental and Property Listing
projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1700
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1700
Exploit
https://github.com/jiahao412/CVE/issues/3
Permissions Required
https://vuldb.com/?ctiid.343490
Third Party Advisory
https://vuldb.com/?id.343490
Third Party Advisory
https://vuldb.com/?submit.741977
More from House Rental and Property Listing
9.8
CVE-2026-0643
projectworlds House Rental and Property Listing Signup register.php unrestricted upload
9.8
CVE-2023-3694
SourceCodester/projectworlds House Rental and Property Listing index.php sql injection
6.1
CVE-2026-0642
projectworlds House Rental and Property Listing complaint.php cross site scripting