Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14693SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization

Medium 5.4

In plain English

A medium-severity security flaw in Multi-Vendor Online Grocery Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Affected by this vulnerability is the function cancel_order of the file classes/Master.php. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Multi-Vendor Online Grocery Management System	1.0

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-376289 | SourceCodester Multi-Vendor Online Grocery Management System Master.php cancel_order improper authorization vdb-entry, technical-description
VDB-376289 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-14693 | CVE Analysis and Report third-party-advisory
Submit #846833 | SourceCodester Multi-Vendor Online Grocery Management System 1.0 Improper Authorization third-party-advisory
https://github.com/lee945/cve/issues/4 exploit, issue-tracking
https://www.sourcecodester.com/ product