CodeAstro Ecommerce CVE-2026-14639

Q: What is the CVSS score of CVE-2026-14639?

CVE-2026-14639 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41683 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-04 cna@vuldb.com

GHSA-qcr5-mvpm-f3r7

PHP SQLi

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable web form requires authenticated customer session (PR:L); SQL injection yields partial data read/write (C:L/I:L) with no described availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 18:31 vuln.today

DescriptionCVE.org

A vulnerability has been found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /ecommerce-website-php/customer/my_account.php?edit_account. Such manipulation of the argument c_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in CodeAstro Ecommerce Website 1.0 exposes authenticated customers to database manipulation via the c_name parameter on the account-editing endpoint. The vulnerability was publicly disclosed with a proof-of-concept exploit referenced on GitHub, meaning exploitation tooling is accessible. Impact is assessed as limited scope - low confidentiality, integrity, and availability - but network reachability and the public PoC raise opportunistic risk for unpatched deployments.

Technical ContextAI

CodeAstro Ecommerce Website 1.0 is a PHP-based e-commerce application. The root cause is classified under CWE-74 (Injection), specifically SQL injection, where user-supplied input to the c_name argument in the account editing handler at /ecommerce-website-php/customer/my_account.php?edit_account is concatenated into a SQL query without parameterization or proper sanitization. This allows an attacker to alter the query's logical structure, potentially reading data from adjacent tables or modifying records. No CPE strings were provided in the source data; the affected version is 1.0 as stated in the NVD description.

RemediationAI

No vendor-released patch has been identified at time of analysis; the absence of a patch advisory from https://codeastro.com/ means the primary fix is code-level remediation. Developers should replace dynamic SQL string concatenation in the c_name handling logic with parameterized queries or prepared statements - this directly eliminates the injection surface with no functional side effects. As a compensating control, deploying a Web Application Firewall with a SQL injection detection rule targeting the c_name parameter in POST requests to the account edit endpoint can block automated exploit attempts, though WAF bypasses are common and this is not a substitute for code-level fixes. Additionally, restricting the database account used by the application to only the tables and operations it requires (principle of least privilege) limits the blast radius of any successful injection. The VulDB entry at https://vuldb.com/vuln/376155 should be monitored for any vendor patch release.