CVE-2026-14694

SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection

LOW 2.1EPSS 0.3%

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected: SourceCodester · Multi-Vendor Online Grocery Management System
CVSS v4.0 VULDB: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULDB: 6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v2.0 VULDB: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 0.33% chance of exploitation in the next 30 days, 25th percentile
Published: 2026-07-05
Updated: 2026-07-06

Proof-of-concept exploits (1)

lee945/cve/issues/50★ · 2026-06-03

CVE-2026-14694

Proof-of-concept exploits (1)

References

Related