Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.
responsive realestate script project responsive realestate script 3.2