CVE-2026-14653
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/mensproductdeletequery.php. An attacker can remotely manipulate the user_id argument, leading to SQL injection. The exploit has been publicly disclosed.
Risk Assessment
The risk includes unauthorized database access, leakage of customer and order data, and potential takeover of the application.
Recommendation
Immediately update the script to the latest version or apply a security patch. In the meantime, filter and validate all input in /admin/mensproductdeletequery.php.
Other vulnerabilities in SourceCodester Simple and Nice Shopping Cart Script
See all- CVE-2026-15703High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/userproductdeletequery.php. Manipulating the user_id argument allows remote attack. The exploit is publicly available.
- CVE-2026-15190High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the /login.php file. An attacker can remotely manipulate the Username argument, leading to unauthorized database access. The exploit is publicly available.
- CVE-2026-14654High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/girlsproductdeletequery.php. An unknown function allows manipulation of the user_id argument, enabling remote SQL injection. The exploit is publicly available and may be used.
- CVE-2026-14652High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been made public and could be used.
Original NVD description (English source)
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /admin/mensproductdeletequery.php. This manipulation of the argument user_id causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.