CVE-2026-14767
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/confirm.php. An attacker can remotely manipulate the invoice_no argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.
Risk Assessment
The risk includes potential theft of customer data, modification of store content, and privilege escalation. The publicly available exploit facilitates the attack.
Recommendation
Immediately update the application to the latest version or apply a security patch. Additionally, validate and sanitize all input data, especially the invoice_no parameter.
Other vulnerabilities in CodeAstro Ecommerce Website
See all- CVE-2026-14799Medium
A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /customer/my_account.php?my_wishlist. Manipulation of the delete_wishlist argument allows remote attackers to execute unauthorized database queries. The exploit has been publicly released, increasing the risk of attacks.
- CVE-2026-14639Medium
A SQL injection vulnerability has been found in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/my_account.php?edit_account. The attack involves manipulating the c_name argument, allowing remote SQL injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.