CVE-2026-19923
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A weakness was identified in code-projects Online Shopping System 1.0 in the file /checkout_process.php. Manipulating the total_count argument can lead to SQL injection. The attack can be launched remotely, and the exploit is public.
Risk Assessment
Risk of database integrity compromise and unauthorized access to customer data. The organization may suffer financial losses and loss of customer trust.
Recommendation
It is recommended to update the system or apply appropriate security measures such as parameterized SQL queries.
Other vulnerabilities in code-projects Online Shopping System
See all- CVE-2026-82701High
A SQL injection vulnerability was found in code-projects Online Shopping System 1.0 in the search functionality. Manipulation of the keyword argument allows remote attack. The exploit has been publicly disclosed.
- CVE-2026-19922Low
A security flaw was discovered in code-projects Online Shopping System 1.0 in the file /checkout.php. Manipulating the amount_1 argument results in cross site scripting. The attack can be initiated remotely, and the exploit is public.
- CVE-2026-19921Medium
A vulnerability was identified in code-projects Online Shopping System 1.0 in the file /homeaction.php. Manipulating the cat_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-19920Medium
A vulnerability was determined in code-projects Online Shopping System 1.0 in the file /action.php. Manipulating the proId argument causes SQL injection. The attack can be initiated remotely, and the exploit is publicly disclosed.
Original NVD description (English source)
A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipulation of the argument total_count can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS