CVE-2026-14799
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in CodeAstro Ecommerce Website 1.0 in the file /customer/my_account.php?my_wishlist. Manipulation of the delete_wishlist argument allows remote attackers to execute unauthorized database queries. The exploit has been publicly released, increasing the risk of attacks.
Risk Assessment
An attacker could gain unauthorized access to sensitive customer data, including personal and financial information, and potentially take control of the application.
Recommendation
Immediately update the application to the latest version or apply a security patch to prevent SQL injection. In the meantime, consider temporarily disabling the wishlist management feature.
Original NVD description (English source)
A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/my_account.php?my_wishlist. The manipulation of the argument delete_wishlist results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.