Description
A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Published: 2026-07-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the update_settings_info function within SystemSettings.php of SourceCodester Multi‑Vendor Online Grocery Management System. A malicious user can manipulate the content[] parameter, causing the application to execute injected code. This flaw is identified as CWE‑74 (Improper Neutralization of Input During Web Page Generation) and CWE‑94 (Improper Control of Generation of Code). The code injection can lead to unauthorized execution on the server, potentially allowing attackers to modify application data or compromise the environment.

Affected Systems

SourceCodester Multi‑Vendor Online Grocery Management System version 1.0 is affected. No other product versions are listed. The vulnerability exists in the Setting Handler component, specifically classes/SystemSettings.php.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate impact; the EPSS score of less than 1% signifies a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog, yet it can be abused remotely through a crafted request to the update_settings_info endpoint. The injection is achieved via the externally reachable content[] parameter. Consequently, remediation is recommended even though automated exploitation is unlikely at present.

Generated by OpenCVE AI on July 24, 2026 at 09:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor patch or update that sanitizes the content[] parameter in update_settings_info.
  • If a patch is not available, restrict the update_settings_info endpoint to authenticated users and add firewall rules to block unauthenticated external requests.
  • Implement rigorous input validation and sanitization for content[] following CWE‑74 guidelines, ensuring no user‑supplied code can be executed.
  • If the endpoint is not required for business operations, disable or tightly restrict it and deploy a web application firewall to block suspicious requests.

Generated by OpenCVE AI on July 24, 2026 at 09:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This impacts the function update_settings_info of the file classes/SystemSettings.php of the component Setting Handler. Such manipulation of the argument content[] leads to code injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Title SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection
First Time appeared Sourcecodester
Sourcecodester multi-vendor Online Grocery Management System
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:sourcecodester:multi-vendor_online_grocery_management_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester multi-vendor Online Grocery Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Multi-vendor Online Grocery Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:21:35.636Z

Reserved: 2026-07-04T04:58:54.895Z

Link: CVE-2026-14691

cve-icon Vulnrichment

Updated: 2026-07-06T16:21:31.619Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T09:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')