Medium severity · published Jul 5, 2026
CVE-2026-14694
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injection
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this issue is the function cancel_order of the file classes/Master.php of the component POST Parameter Handler. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Multi-Vendor Online Grocery Management System · SourceCodester
1.0 · source: vendor
Affected product
MO
Multi-Vendor Online Grocery Management System
SourceCodester
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14694
github.com
https://github.com/lee945/cve/issues/5
vuldb.com
https://vuldb.com/cve/CVE-2026-14694
vuldb.com
https://vuldb.com/submit/846834
vuldb.com
https://vuldb.com/vuln/376290
vuldb.com
https://vuldb.com/vuln/376290/cti
www.sourcecodester.com
https://www.sourcecodester.com/
More from Multi-Vendor Online Grocery Management System
7.3
CVE-2026-14695
SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injection
7.3
CVE-2026-14690
SourceCodester Multi-Vendor Online Grocery Management System Users.php save_users improper authorization
6.3
CVE-2026-14692
SourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php save_shop_type sql injection
6.3
CVE-2026-14691
SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection
5.4
CVE-2026-14693
SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization