CVE-2026-14691 MEDIUM

CVE-2026-14691: SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection

Vendor Sourcecodester
Product Multi-Vendor Online Grocery Management System
Weakness CWE-94 · Code injection
Published July 5, 2026
Last update July 5, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Key dates

02Disclosure timeline

July 5, 2026 CVE published

Related vulnerabilities

04Related CVE