CVE-2026-14654 MEDIUM

CVE-2026-14654: SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection

Vendor Sourcecodester

Product Simple and Nice Shopping Cart Script

Weakness CWE-89 · SQLi

Published July 4, 2026

Last update July 6, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in SourceCodester Simple and Nice Shopping Cart Script 1.0. Affected is an unknown function of the file /admin/girlsproductdeletequery.php. Such manipulation of the argument user_id leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Key dates

02Disclosure timeline

July 4, 2026 CVE published

July 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-14654 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

Identifiers

CVE CVE-2026-14654

CWE CWE-89

CVSS 6.9 / MEDIUM

Affected versions