CVE-2026-15703
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/userproductdeletequery.php. Manipulating the user_id argument allows remote attack. The exploit is publicly available.
Risk Assessment
An attacker can remotely steal, modify, or delete database data, leading to a breach of data confidentiality and integrity, and potential application takeover.
Recommendation
Immediately update the script to the latest version or apply a patch to prevent SQL injection, e.g., by using parameterized queries. Until the fix is applied, restrict access to /admin/userproductdeletequery.php.
Other vulnerabilities in SourceCodester Simple and Nice Shopping Cart Script
See all- CVE-2026-15190High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the /login.php file. An attacker can remotely manipulate the Username argument, leading to unauthorized database access. The exploit is publicly available.
- CVE-2026-14654High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/girlsproductdeletequery.php. An unknown function allows manipulation of the user_id argument, enabling remote SQL injection. The exploit is publicly available and may be used.
- CVE-2026-14653High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/mensproductdeletequery.php. An attacker can remotely manipulate the user_id argument, leading to SQL injection. The exploit has been publicly disclosed.
- CVE-2026-14652High
A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been made public and could be used.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.