Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14767CodeAstro Ecommerce Website POST Parameter confirm.php sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Ecommerce Website from CodeAstro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 73.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
CodeAstro	Ecommerce Website	1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-376357 | CodeAstro Ecommerce Website POST Parameter confirm.php sql injection vdb-entry, technical-description
VDB-376357 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-14767 | CVE Analysis and Report third-party-advisory
Submit #850623 | Codeastro Ecommerce Website V1.0 SQL Injection third-party-advisory
https://gist.github.com/menelausx/2222914494e28e7d70f9a35af8fae824 exploit
https://codeastro.com/ product