CVE-2026-14767 MEDIUM

CVE-2026-14767: CodeAstro Ecommerce Website POST Parameter confirm.php sql injection

Vendor Codeastro
Product Ecommerce Website
Weakness CWE-89 · SQLi
Published July 5, 2026
Last update July 6, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Key dates

02Disclosure timeline

July 5, 2026 CVE published
July 6, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability CVE-2026-66446 WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability CVE-2026-66430 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability CVE-2026-28156 WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability CVE-2026-65547 WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability