Shopping Cart Script CVE-2026-14654

Q: What is the CVSS score of CVE-2026-14654?

CVE-2026-14654 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-04 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L assigned because the /admin/ path implies at minimum low-privilege authentication is realistically required; C/I/A:L reflects constrained database-level impact without full system compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 21:31 vuln.today

DescriptionCVE.org

A vulnerability was identified in SourceCodester Simple and Nice Shopping Cart Script 1.0. Affected is an unknown function of the file /admin/girlsproductdeletequery.php. Such manipulation of the argument user_id leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the database to remote query manipulation via the user_id parameter in /admin/girlsproductdeletequery.php. The CVSS 4.0 vector rates this as network-exploitable with no authentication required (PR:N), though the /admin/ path location raises questions about whether authentication is enforced in practice - a discrepancy worth verifying in deployment. A publicly available exploit exists per VulDB, though the vulnerability is not listed in CISA KEV and the overall CVSS 4.0 score of 5.5 reflects limited impact across confidentiality, integrity, and availability.

Technical ContextAI

The affected application is a PHP-based shopping cart script distributed via SourceCodester, a site offering free PHP project downloads primarily targeting students and small developers. The vulnerable file girlsproductdeletequery.php processes a user_id GET or POST parameter without sanitization before constructing a SQL DELETE or SELECT query, enabling classic SQL injection. CWE-74 covers Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection), which is the parent class encompassing SQL injection - indicating the raw user-supplied input is passed directly into a downstream SQL interpreter. No CPE string was provided, but the product is confirmed as version 1.0 from sourcecodester.com. The backend database technology is not specified but is typical MySQL for SourceCodester PHP projects.

Affected ProductsAI

SourceCodester Simple and Nice Shopping Cart Script version 1.0 is the sole confirmed affected product. The vulnerability is in the file /admin/girlsproductdeletequery.php. No CPE string was included in the available data. The product is distributed at sourcecodester.com. No other versions are referenced and no prior affected version range has been identified beyond version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to rewrite the SQL query in girlsproductdeletequery.php to use parameterized prepared statements (e.g., PHP PDO or MySQLi prepared statements) rather than interpolating the user_id value directly into the query string. As an immediate compensating control, restrict access to the /admin/ directory via HTTP authentication at the web server level (e.g., Apache .htaccess or nginx auth_basic) if not already enforced - this raises the effective privilege bar and limits exposure from the PR:N assessment. Input validation (allowlist of integer-only values for user_id) can serve as a defense-in-depth measure but should not replace parameterization. If the application is not actively used in production, take it offline until patched. Reference: VulDB entry at https://vuldb.com/vuln/376167 and the researcher's POC at https://github.com/Yuesswor/cve/issues/4.