Is there a public PoC exploit available for CVE-2026-14652?

Yes, a public proof-of-concept exploit is available for CVE-2026-14652. Prioritise patching immediately. EPSS: 0.4%.

Shopping Cart Script CVE-2026-14652

Q: What is the CVSS score of CVE-2026-14652?

CVE-2026-14652 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

PHP SQLi Simple And Nice Shopping Cart Script Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible login page requires no credentials (PR:N), trivial SQLi with no special conditions (AC:L), limited per-request impact consistent with CVSS 4.0 VC/VI/VA:L baseline.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 21:22 vuln.today

CVSS changed

Jul 04, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown function of the file /admin/login.php of the component Admin Login. The manipulation of the argument Username results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the admin login interface to remote unauthenticated attackers through unsanitized input in the Username parameter of /admin/login.php. The CVSS 4.0 score of 6.9 (Medium) reflects limited per-request impact (VC:L/VI:L/VA:L), but a publicly available proof-of-concept exploit (E:P) on GitHub substantially lowers the exploitation bar for opportunistic attackers. No KEV listing exists at time of analysis; however, the trivial attack complexity (AC:L, AT:N, PR:N, UI:N) combined with public exploit code makes any internet-facing deployment of this script an immediate remediation priority.

Technical ContextAI

The affected application is a PHP-based e-commerce script distributed by SourceCodester (sourcecodester.com), a platform offering free PHP/MySQL scripts primarily for educational and demonstration use. The CPE string cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:* covers all versions, with version 1.0 confirmed as affected. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: the Username parameter passed to /admin/login.php is concatenated directly into an SQL query without parameterization or prepared statements, allowing an attacker to inject arbitrary SQL syntax. This is a classic first-generation SQLi pattern common in legacy PHP applications that use mysql_query() or similar unsanitized query construction rather than PDO or MySQLi with bound parameters.

RemediationAI

No vendor-released patch has been identified at time of analysis. If source code access is available, the primary fix is to replace direct SQL string concatenation in /admin/login.php with parameterized queries using PHP's PDO or MySQLi prepared statements - this eliminates the injection vector entirely. As an immediate compensating control, restrict access to the /admin/ directory to trusted IP ranges via web server configuration (Apache .htaccess AllowFrom or nginx allow/deny directives); this limits the attack surface to known management networks but does not fix the underlying flaw and may be bypassed if an attacker has network access to an allowed range. Deploying a web application firewall rule blocking SQL metacharacters (single quotes, double dashes, UNION, SELECT keywords) in POST body parameters is an additional layer but carries a risk of false positives on legitimate input. If the application is not actively used in production, take it offline entirely. Monitor VulDB entry https://vuldb.com/vuln/376165 and sourcecodester.com for any future patch release.