Is there a public PoC exploit available for CVE-2026-14653?

Yes, a public proof-of-concept exploit is available for CVE-2026-14653. Prioritise patching immediately. EPSS: 0.4%.

Simple and Nice Shopping Cart Script CVE-2026-14653

Q: What is the CVSS score of CVE-2026-14653?

CVE-2026-14653 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

MEDIUM

SQL Injection (CWE-89)

2026-07-04 VulDB

PHP SQLi Simple And Nice Shopping Cart Script Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable unauthenticated endpoint per CVSS 4.0 PR:N; partial C/I/A impacts reflect limited SQLi scope without evidence of full DB compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 04, 2026 - 21:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 04, 2026 - 21:21 vuln.today

DescriptionCVE.org

A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /admin/mensproductdeletequery.php. This manipulation of the argument user_id causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote, unauthenticated attackers to manipulate database queries through the user_id parameter in /admin/mensproductdeletequery.php, exposing partial confidentiality, integrity, and availability of the underlying database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required for exploitation over the network. A public exploit has been disclosed on GitHub, elevating the practical risk above the raw score suggests - though this is not confirmed as actively exploited by CISA KEV at time of analysis.

Technical ContextAI

The affected product, identified via CPE cpe:2.3:a:sourcecodester:simple_and_nice_shopping_cart_script:*:*:*:*:*:*:*:*, is a PHP-based shopping cart application distributed by SourceCodester, a Philippine platform publishing open-source PHP scripts primarily for educational and small-business use. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause - the user_id parameter in /admin/mensproductdeletequery.php is directly interpolated into a SQL query without parameterized statements or sanitization, allowing attackers to alter query logic. This class of vulnerability is historically prevalent in PHP scripts that rely on direct $_GET/$_POST variable insertion into query strings, a pattern common in SourceCodester-distributed code. The /admin/ path suggests an administrative interface, though the CVSS PR:N metric indicates the endpoint may be accessible without authentication, which is consistent with SourceCodester scripts that often ship with unprotected admin panels.

RemediationAI

No vendor-released patch has been identified at time of analysis - the SourceCodester project page carries no advisory and the CPE wildcard indicates no fixed version is known. The primary remediation is to replace direct SQL string interpolation in /admin/mensproductdeletequery.php with PHP PDO or MySQLi prepared statements, binding the user_id parameter as a typed placeholder rather than concatenating it into the query. As a compensating control, restrict network access to the /admin/ directory via web server configuration (e.g., Apache .htaccess IP allowlisting or nginx location directives), and enforce HTTP authentication at the web server layer as a stopgap - note this adds a login prompt but does not fix the underlying injection flaw. Additionally, apply least-privilege database credentials so the PHP application account cannot perform DROP, CREATE, or FILE operations, limiting blast radius if exploited. The public PoC is documented at https://github.com/Yuesswor/cve/issues/3 and the VulDB entry at https://vuldb.com/cve/CVE-2026-14653 should be monitored for patch updates.