CVE-2026-14694: medium-severity vulnerability in SourceCodester Multi-Vendor Online Grocery…
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 75% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
SourceCodester · Multi-Vendor Online Grocery Management Systempublic PoCs found — 1
cve_referencegithub.com/lee945/cve/issues/5unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SourceCodester Multi-Vendor Online Grocery…
In the same product, most dangerous first.
CVE-2026-14690MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorizationEPSS 0.5%CVE-2026-14695MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injectionEPSS 0.4%CVE-2026-14691MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injectionEPSS 0.4%CVE-2026-14693MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorizationEPSS 0.4%CVE-2026-14692MEDIUMSourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save_shop_type sql injectionEPSS 0.3%