CVE-2026-14695
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.
Risk Assessment
An attacker can remotely execute arbitrary SQL queries, potentially leading to data leakage, database modification, or privilege escalation in the grocery management system.
Recommendation
Immediately update the system to the latest version or apply a security patch. In the meantime, validate and sanitize input data in the Name argument.
Other vulnerabilities in SourceCodester Multi-Vendor Online Grocery Management System
See all- CVE-2026-14694Medium
A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.
- CVE-2026-14693Medium
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.
- CVE-2026-14692Medium
A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-14691Medium
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.
- CVE-2026-14690High
A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_client of the file classes/Users.php of the component Registration Handler. The manipulation of the argument Name results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.