CVE-2026-14693
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.
Risk Assessment
The organization is at risk of unauthorized order cancellation by a remote attacker, which can disrupt business processes and compromise data integrity.
Recommendation
Immediately update the system to the latest version or apply the available patch. If not available, temporarily restrict access to classes/Master.php and implement access control mechanisms.
Other vulnerabilities in SourceCodester Multi-Vendor Online Grocery Management System
See all- CVE-2026-14695High
A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.
- CVE-2026-14694Medium
A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.
- CVE-2026-14692Medium
A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-14691Medium
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14690High
A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the file classes/Master.php. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used.