Is there a public PoC exploit available for CVE-2026-14690?

Yes, a public proof-of-concept exploit is available for CVE-2026-14690. Prioritise patching immediately. EPSS: 0.3%.

Grocery Management System CVE-2026-14690

Q: What is the CVSS score of CVE-2026-14690?

CVE-2026-14690 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41712 MEDIUM

Improper Authorization (CWE-285)

2026-07-05 VulDB

GHSA-4r3p-cxgg-r53c

PHP Authentication Bypass Multi Vendor Online Grocery Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible endpoint, no privileges or interaction required; scope unchanged; low CIA impact consistent with CVSS 4.0 VC:L/VI:L/VA:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:01 vuln.today

CVSS changed

Jul 05, 2026 - 02:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

Improper authorization in SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows remote unauthenticated attackers to invoke the save_users function in classes/Users.php without valid authorization checks, enabling unauthorized user account creation or modification. The CVSS 4.0 vector confirms network-accessible, zero-privilege exploitation with low confidentiality, integrity, and availability impact on the vulnerable system. A public proof-of-concept exploit exists (GitHub), and no CISA KEV listing indicates active widespread exploitation has not been confirmed at time of analysis.

Technical ContextAI

The affected product is a PHP-based multi-vendor e-commerce application distributed by SourceCodester, a provider of open-source academic and demo web applications. The vulnerability resides in classes/Users.php within the save_users function - a server-side PHP handler responsible for persisting user records. CWE-285 (Improper Authorization) indicates the function fails to enforce access control checks before executing privileged operations, consistent with the 'Authentication Bypass' tag. The CPE string cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:* confirms only version 1.0 is currently enumerated as affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is directly network-reachable with no special attack prerequisites.

RemediationAI

No vendor-released patch has been identified at time of analysis; SourceCodester has not published a security advisory or fixed release for this issue. As an immediate compensating control, restrict network access to the classes/Users.php endpoint via web server configuration (e.g., deny direct HTTP access to the classes/ directory in Apache .htaccess or nginx location blocks), which prevents direct invocation of save_users without routing through authenticated application logic - note this may break functionality if the endpoint is called legitimately by front-end code and requires testing. Additionally, implement application-level session and role checks at the top of the save_users function as a code-level fix. For deployments in production, consider taking the application offline until a patched version is available, given the unauthenticated network-accessible nature of the flaw. References: VulDB entry https://vuldb.com/vuln/376286, PoC issue https://github.com/lee945/cve/issues/1.