CVE-2026-14691

Name of the Vulnerable Software and Affected Versions SourceCodester Multi-Vendor Online Grocery Management System version 1.0

Description Code injection is possible via the Setting Handler component in the update settings info() function located in the classes/SystemSettings.php file. A remote attacker can execute this by manipulating the content[] argument.

Recommendations As a temporary workaround, restrict access to the update settings info() function in the classes/SystemSettings.php file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.