Is there a public PoC exploit available for CVE-2026-14694?

Yes, a public proof-of-concept exploit is available for CVE-2026-14694. Prioritise patching immediately. EPSS: 0.2%.

Multi-Vendor Grocery CVE-2026-14694

Q: What is the CVSS score of CVE-2026-14694?

CVE-2026-14694 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41717 LOW

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-m6h7-g9xx-qhpj

PHP SQLi Multi Vendor Online Grocery Management System Sourcecodester

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable SQLi with low auth; C:H and I:H reflect full DB read/write; A:L since DoS via DB is possible but not primary impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:29 vuln.today

Severity Changed

Jul 05, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows a remote low-privileged attacker to manipulate database queries via the ID POST parameter in the cancel_order function of classes/Master.php. The flaw is a classic CWE-89 unsanitized parameter passed directly into a SQL statement, enabling data extraction, modification, or potential authentication bypass within the application database. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk beyond the conservative CVSS 4.0 base score of 2.1.

Technical ContextAI

The affected product is a PHP-based multi-vendor grocery e-commerce application distributed by SourceCodester (cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:*), version 1.0. The vulnerable code path is the cancel_order method inside classes/Master.php, a PHP class file that handles data operations. The function accepts a POST parameter named ID without adequate sanitization or parameterized query usage, inserting user-supplied input directly into a SQL query - a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). This class-based PHP pattern is common in SourceCodester projects and often lacks prepared statements, making it a recurring vulnerability class across their portfolio.

RemediationAI

No vendor-released patch or security advisory has been identified at time of analysis; SourceCodester projects are typically distributed as source code without a formal patch lifecycle. The primary remediation is to refactor classes/Master.php in the cancel_order function to use PHP PDO or MySQLi prepared statements with bound parameters for the ID input, eliminating the injection surface entirely. As a compensating control, restrict access to the affected endpoint via web application firewall rules that detect and block SQL metacharacter injection patterns (single quotes, SQL keywords such as UNION/SELECT in POST bodies). Additionally, enforce strict input validation at the application layer - the ID parameter should accept only numeric values and be rejected otherwise, which is a zero-side-effect mitigation. Operators should also audit all other methods in classes/Master.php and similar class files for the same unsanitized parameter pattern, as this is a systemic issue common to SourceCodester codebases. References: https://vuldb.com/vuln/376290, https://github.com/lee945/cve/issues/5.