CVE-2026-14692
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes unauthorized database access, sensitive data leakage, and potential data modification or deletion. The attack could lead to full system compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and parameterized queries in the save_shop_type function.
Other vulnerabilities in SourceCodester Multi-Vendor Online Grocery Management System
See all- CVE-2026-14695High
A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.
- CVE-2026-14694Medium
A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.
- CVE-2026-14693Medium
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.
- CVE-2026-14691Medium
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14690High
A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function save_shop_type of the file classes/Master.php of the component POST Parameter Handler. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.