Is there a public PoC exploit available for CVE-2026-14693?

Yes, a public proof-of-concept exploit is available for CVE-2026-14693. Prioritise patching immediately. EPSS: 0.2%.

Multi-Vendor Grocery CVE-2026-14693

Q: What is the CVSS score of CVE-2026-14693?

CVE-2026-14693 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41716 LOW

Improper Authorization (CWE-285)

2026-07-05 VulDB

GHSA-v5rw-jc7q-7hfw

PHP Authentication Bypass Multi Vendor Online Grocery Management System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-exploitable with low privileges required (registered account); no scope change; only limited integrity and availability impact from unauthorized order cancellation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:28 vuln.today

Severity Changed

Jul 05, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the file classes/Master.php. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used.

AnalysisAI

Improper authorization in SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows a low-privileged remote attacker to invoke the cancel_order function in classes/Master.php against orders they do not own, enabling unauthorized order cancellation and limited disruption of platform integrity. The vulnerability stems from CWE-285 (Improper Authorization) - the application fails to verify that the requesting user has authority over the targeted order resource. A proof-of-concept exploit has been publicly disclosed on GitHub, lowering the bar for exploitation; however, no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The affected product is SourceCodester Multi-Vendor Online Grocery Management System version 1.0, a PHP-based web application (CPE: cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:*). The vulnerable code path is the cancel_order function within classes/Master.php, a server-side PHP class handler likely invoked via an AJAX or direct HTTP request. CWE-285 (Improper Authorization) indicates the function performs no adequate ownership check - it processes a cancel request for an order ID without confirming the authenticated session user is the order's owner, a classic server-side authorization bypass pattern (often referred to as an IDOR - Insecure Direct Object Reference). The CVSS 4.0 vector confirms network delivery (AV:N), no attack complexity barrier (AC:L), and no additional attack prerequisites (AT:N), consistent with a straightforward parameter manipulation attack.

RemediationAI

No vendor-released patch has been identified at time of analysis - the fix version is not confirmed from the available references. The immediate recommended remediation is to add a server-side ownership check inside the cancel_order function in classes/Master.php, verifying that the session user ID matches the user_id associated with the order being cancelled before processing the cancellation. Until a patch is available, deployers can mitigate risk by restricting account registration to trusted users only, which reduces the pool of potential attackers to known parties. Additionally, implementing application-level rate limiting on order cancellation endpoints can reduce abuse velocity. Web application firewall rules that flag unusually high volumes of cancel_order requests from a single session may also provide early detection. Consult the VulDB entry at https://vuldb.com/vuln/376289 and the POC at https://github.com/lee945/cve/issues/4 for technical details to inform patch development. Trade-off: restricting registration limits platform growth; rate limiting may affect legitimate bulk users.