Is there a public PoC exploit available for CVE-2026-14799?

Yes, a public proof-of-concept exploit is available for CVE-2026-14799. Prioritise patching immediately. EPSS: 0.2%.

CodeAstro Ecommerce Website CVE-2026-14799

Q: What is the CVSS score of CVE-2026-14799?

CVE-2026-14799 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41810 LOW

SQL Injection (CWE-89)

2026-07-06 VulDB

GHSA-wqr6-r6pc-pgx2

PHP SQLi Ecommerce Website Codeastro

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible SQLi requiring only a customer session (PR:L); partial C/I/A impact consistent with application-scope database read/write, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 06, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 06, 2026 - 06:20 vuln.today

CVE Published

Jul 06, 2026 - 05:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/my_account.php?my_wishlist. The manipulation of the argument delete_wishlist results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in CodeAstro Ecommerce Website 1.0 exposes the /customer/my_account.php?my_wishlist endpoint to database manipulation via the unsanitized delete_wishlist parameter, allowing remote attackers with a valid customer account to read or modify backend database contents. The CVSS 4.0 vector (PR:L) confirms exploitation requires an authenticated customer session, constraining the attack surface to registered users. A public proof-of-concept exploit has been released, no public exploit identified as confirmed actively exploited (not in CISA KEV), though the low barrier to exploitation once authenticated elevates practical risk.

Technical ContextAI

The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a PHP-based ecommerce application. The delete_wishlist GET/POST argument passed to /customer/my_account.php is incorporated into a SQL query without parameterization or sufficient escaping, enabling an attacker to alter query logic. CPE cpe:2.3:a:codeastro:ecommerce_website:*:*:*:*:*:*:*:* uses a wildcard version, suggesting the flaw is present across all tracked versions including 1.0. CodeAstro distributes free PHP web application templates primarily targeting small ecommerce deployments, and the codebase is publicly downloadable from codeastro.com, which also makes it straightforward for attackers to study the source prior to exploitation.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor site (codeastro.com) does not publish a corresponding security advisory. Operators should immediately apply parameterized queries or prepared statements to the delete_wishlist parameter handling in /customer/my_account.php if running a self-hosted instance with access to source code. As a compensating control, deploying a Web Application Firewall (WAF) rule to block SQL metacharacters in the delete_wishlist parameter will reduce exposure but may break legitimate wishlist deletion if not tuned carefully. Restricting customer self-registration to known users removes the PR:L attack path entirely. Database account privilege reduction - ensuring the web application's database user has only SELECT/INSERT/UPDATE on required tables rather than broad permissions - limits the blast radius of successful injection. Monitoring database query logs for anomalous patterns (UNION, OR 1=1, stacked queries) can support detection. Reference: VulDB entry https://vuldb.com/vuln/376393 and exploit PoC at https://github.com/lilukun337/cve/issues/8.