CVE-2026-14639
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability has been found in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/my_account.php?edit_account. The attack involves manipulating the c_name argument, allowing remote SQL injection. The exploit has been publicly disclosed.
Risk Assessment
The risk includes unauthorized database access, customer data leakage, and potential application takeover.
Recommendation
Immediately update the application to the latest version or apply a patch to prevent SQL injection, e.g., by using parameterized queries.
Other vulnerabilities in CodeAstro Ecommerce Website
See all- CVE-2026-14799Medium
A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /customer/my_account.php?my_wishlist. Manipulation of the delete_wishlist argument allows remote attackers to execute unauthorized database queries. The exploit has been publicly released, increasing the risk of attacks.
- CVE-2026-14767Medium
A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/confirm.php. An attacker can remotely manipulate the invoice_no argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
Original NVD description (English source)
A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?edit_account. Such manipulation of the argument c_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.