CVE-2026-14691
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.
Risk Assessment
The risk for the organization includes remote code execution, potentially leading to system compromise, data theft, or service disruption.
Recommendation
It is recommended to immediately update the system to the latest version or apply a vendor-provided patch. Until then, restrict access to the admin panel and monitor logs for suspicious activity.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.