CVE-2026-14694
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 5, 2026
- Updated
- Jul 6, 2026
- Reserved
- Jul 4, 2026
Description
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Multi-Vendor Online Grocery Management SystemSourceCodester |
|
References
- VDB-376290 | SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injectionvdb-entrytechnical-description
- VDB-376290 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-14694 | CVE Analysis and Reportthird-party-advisory
- Submit #846834 | SourceCodester Multi-Vendor Online Grocery Management System 1.0 SQL Injectionthird-party-advisory
- https://github.com/lee945/cve/issues/5exploitissue-tracking
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.