CVE-2026-14690
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized access to user management functions, potentially allowing attackers to modify accounts, escalate privileges, or steal data.
Recommendation
Immediately update the system to the latest version or apply temporary mitigations such as strengthening access controls in classes/Users.php and monitoring for suspicious requests.
Other vulnerabilities in SourceCodester Multi-Vendor Online Grocery Management System
See all- CVE-2026-14695High
A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.
- CVE-2026-14694Medium
A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.
- CVE-2026-14693Medium
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.
- CVE-2026-14692Medium
A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-14691Medium
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.