CVE-2026-14692

Name of the Vulnerable Software and Affected Versions SourceCodester Multi-Vendor Online Grocery Management System versions 1.0 through 5.7.26

Description Remote manipulation of the POST Parameter Handler component leads to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The issue resides in the save shop type() function within the classes/Master.php file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the save shop type() function in the classes/Master.php file to minimize the risk of exploitation.