Is there a public PoC exploit available for CVE-2026-14692?

Yes, a public proof-of-concept exploit is available for CVE-2026-14692. Prioritise patching immediately. EPSS: 0.2%.

Grocery Management System CVE-2026-14692

Q: What is the CVSS score of CVE-2026-14692?

CVE-2026-14692 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41715 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-9fw9-6v7j-4wv9

PHP SQLi Multi Vendor Online Grocery Management System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable SQL injection but requires authenticated POST request (PR:L); partial C/I/A reflects data read/write access without full system or scope compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:27 vuln.today

Severity Changed

Jul 05, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. Affected is the function save_shop_type of the file classes/Master.php of the component POST Parameter Handler. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Multi-Vendor Online Grocery Management System versions 1.0 and 5.7.26 allows remote authenticated attackers to manipulate backend database queries through unsanitized POST parameters passed to the save_shop_type function in classes/Master.php. A public proof-of-concept exploit is available via GitHub, lowering the exploitation barrier for any actor who has obtained application credentials. The CVSS 4.0 score of 2.1 reflects partial confidentiality, integrity, and availability impact rather than full database compromise, and no patch has been confirmed available at time of analysis.

Technical ContextAI

The affected application is a PHP-based multi-vendor e-commerce platform distributed by SourceCodester, a repository commonly used for student and demonstration web projects. The vulnerable component is the save_shop_type function within classes/Master.php, which processes HTTP POST parameters and constructs SQL queries without adequate sanitization or parameterization. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause - user-controlled input reaches the database query string directly, enabling classic SQL injection. The CPE identifier cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:* covers all sub-versions under this product line. The PHP stack with a likely MySQL backend is the canonical environment where this class of flaw is exploitable.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary recommended fix is to replace direct string concatenation in the save_shop_type function of classes/Master.php with parameterized prepared statements (PDO or MySQLi with bound parameters), which eliminates the injection surface entirely. As a compensating control, deploying a web application firewall (WAF) with SQL injection rulesets can detect and block common payloads targeting this endpoint, though WAF bypass techniques exist and this is not a substitute for code-level remediation. Restricting access to the affected POST endpoint to trusted IP ranges or authenticated administrative roles reduces exposure. Given this is a SourceCodester demo project, organizations should strongly evaluate whether the application should be in a production environment at all; if so, a full code audit for additional injection points is warranted given the pattern of unsanitized input handling. Reference the VulDB advisory at https://vuldb.com/vuln/376288 for updated patch status.