Is there a public PoC exploit available for EUVD-2026-41718?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41718. Prioritise patching immediately. EPSS: 0.3%.

Multi-Vendor Grocery EUVD-2026-41718

Q: What is the CVSS score of EUVD-2026-41718?

EUVD-2026-41718 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14695 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-63xw-cmj4-rvfq

PHP SQLi Multi Vendor Online Grocery Management System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Registration endpoint is network-accessible with no auth; impact limited to low-level DB read/write, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 04:30 vuln.today

CVSS changed

Jul 05, 2026 - 03:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_client of the file classes/Users.php of the component Registration Handler. The manipulation of the argument Name results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Name argument in the save_client function of the registration handler. The vulnerability resides in classes/Users.php and is exploitable without any prior authentication, as it targets the public-facing user registration flow. A public proof-of-concept exploit has been published on GitHub, and no KEV listing exists, though the low-friction exploitation path and public PoC elevate urgency for any live deployment of this software.

Technical ContextAI

The affected component is the PHP-based registration handler (classes/Users.php) within SourceCodester's Multi-Vendor Online Grocery Management System, a free open-source PHP/MySQL web application. The save_client function processes user-supplied registration input, including the Name parameter, without adequate sanitization or parameterized query use, resulting in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CPE string cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:* confirms version 1.0 is affected. The root cause is unsanitized concatenation of user input directly into SQL query strings, a classic and well-understood injection pattern. The CVSS 4.0 base vector AV:N/AC:L/AT:N/PR:N/UI:N reflects that no prerequisites beyond network access are required.

RemediationAI

No vendor-released patch has been identified at the time of analysis; SourceCodester has not published an advisory or updated release. The primary remediation is to replace direct SQL string concatenation in the save_client function (classes/Users.php) with parameterized queries or prepared statements using PHP's PDO or MySQLi extensions - this eliminates the root cause without side effects. As an interim compensating control, operators should implement input validation to restrict the Name field to alphanumeric characters and enforce maximum length, which reduces but does not eliminate injection risk. Web application firewall (WAF) rules targeting SQL metacharacters in registration form fields can provide additional detection and blocking. Given the absence of a vendor patch, organizations running this software in any live or semi-production context should strongly consider taking the application offline until the code is manually patched or replaced. Reference: https://vuldb.com/vuln/376291 and the PoC at https://github.com/lee945/cve/issues/6 for reproduction details.