CVE-2026-14695

SourceCodester Multi-Vendor Online Grocery Management System Registration Users.php save_client sql injection

No known exploitation. EPSS puts it in the 36th percentile. No fix published yet.

CVSS 3.17.3High EPSS percentile36th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-07-05Updated 2026-07-07Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

SourceCodester Multi-Vendor Online Grocery Management SystemAffected: 1.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Multi-Vendor Online Grocery Management System (SourceCodester) is running version 1.0 and whether the registration flow calls classes/Users.php → save_client.
If registration is reachable from the internet, temporarily restrict or disable public registration (allow only after you confirm the fix/mitigation with your vendor/IT).
Have your IT vendor verify whether an official patch exists for CVE-2026-14695; the provided sources include no fix/patch version, so request guidance specific to your deployment.
Until patched, add compensating controls: block/limit access to the registration endpoint at your web application firewall (WAF) or reverse proxy, and rate-limit POST requests targeting registration.
Review application and web server logs for unusual registration attempts, repeated failures, or spikes in requests around the registration endpoint, and preserve logs for investigation.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_client of the file classes/Users.php of the component Registration Handler. The manipulation of the argument Name results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

In plain language

Written by AI from the record

CVE-2026-14695 is a flaw in SourceCodester’s Multi-Vendor Online Grocery Management System where a remote attacker can trick the registration form into running unsafe database commands—if your site is public and registration is reachable, this is a serious thing to address quickly.

CVE-2026-14695 is an unauthenticated SQL injection in the Registration Handler’s `save_client` function in `classes/Users.php`, where the attacker controls the `Name` input to make the server execute malicious SQL remotely.

If you're affected

Customer account takeover
Customer data exposure
Database data manipulation
Service disruption risk

What is it

This vulnerability is like someone being able to write a “hidden instruction” inside a field on your registration form. Instead of just saving a person’s name, the system could be tricked into running unsafe commands on its database. That can lead to stolen or changed customer information, or other disruptions, especially when the registration feature is available to the public.

Who is affected

This matters if you run SourceCodester’s Multi-Vendor Online Grocery Management System and version 1.0 is installed and in use. It specifically affects the registration process (the save_client function in classes/Users.php).

It’s a risk when attackers can reach the registration handler over the network (remote access) and the Name input is processed by save_client without proper protection; the findings indicate no login is required to attempt the attack.

How urgent is it

Treat this as high priority. The issue is remotely reachable and does not require a login, so an attacker can try it directly against your public-facing app.

Because no official fix details are available in the provided information, focus on quickly confirming exposure and applying temporary protections while you work with your IT/vendor for a patch or upgrade path.

What to do — in detail

Confirm whether you’re exposed

Verify the application version: confirm you are actually on SourceCodester Multi-Vendor Online Grocery Management System 1.0.
Confirm the vulnerable path is in use: during registration, check that the request ultimately reaches classes/Users.php → save_client and that it takes Name from user input.
Confirm public reachability: determine whether the registration endpoint is accessible from the internet (not only internally) and whether registration is currently enabled.

Mitigate immediately (if registration is internet-reachable)

Temporarily disable or restrict public registration (e.g., require admin approval for new accounts) until you have a confirmed patch/upgrade.
Add request filtering at the edge:
- Rate-limit POST/requests to the registration endpoint.
- If you have a WAF/reverse proxy, create rules to flag/block common SQL injection patterns in fields used during registration (especially the Name field).
Validate your server-side defenses if they exist:
- Ensure parameterized queries/prepared statements are used for saving client data.
- Ensure input validation rejects unexpected characters/lengths for Name (note: validation alone is not a complete fix, but it can reduce risk).

Patch/upgrade path

No fix/patch information is available in the provided sources. Ask your software vendor/IT partner for the exact updated version (or a backported fix) that addresses CVE-2026-14695 for your deployment.
If you upgrade, re-test the registration flow to ensure save_client no longer forms SQL using unsafely handled Name input.

What to monitor

Log review for registration endpoint requests with unusual payloads, spikes in traffic, or repeated failures.
Any unexpected database errors during registration.
Unexpected new accounts or changes in customer records that don’t match your normal signup patterns.

Technical context

CVE-2026-14695 is an SQL injection involving save_client in classes/Users.php within the Registration Handler component of SourceCodester Multi-Vendor Online Grocery Management System 1.0. The attacker controls the Name argument, allowing remote manipulation of how SQL queries are constructed/executed.

Reachability: Remote attack vector is stated, with no authentication required and no user interaction required. The sources do not list whether default configurations make it reachable, but they do indicate the registration handler component/function is accessible under the stated preconditions.

Exploitation status: No public exploit code is on record in the provided findings, and the vulnerability is not listed in CISA KEV.

Fix status: The provided sources include no patch/version details, so remediation requires confirmation from the vendor or a code-level fix (typically parameterized database access) and/or an upgrade once an official version is identified.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-07-07Record updated
2026-07-06Record updated
2026-07-05Publishedweakness classified, att&ck mapped, record updated

Affected products

SourceCodestercommercial · PH
- Multi-Vendor Online Grocery Management SystemOn-premWeb & CMS Plugins / cms-core

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Scored 7.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity LowData modification is possible but limited in scope or consequence
Availability LowReduced performance or intermittent disruption of service