# CVE-2026-14652: SourceCodester Simple and Nice Shopping Cart Script SQL injection in Admin Login

Source: https://junglewise.ai/threats/cve-2026-14652-sourcecodester-simple-and-nice-shopping-cart-script-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-04. Updated: 2026-07-04  
License: CC BY 4.0 with a link back

CVE-2026-14652 · Severity: high · CVSS 7.3 · Published 2026-07-04

A vulnerability exists in the SourceCodester Simple and Nice Shopping Cart Script, a web application used for managing online stores. An attacker can exploit a flaw in the administrative login page to bypass security controls and interact directly with the underlying database. This could lead to unauthorized access to the management console, exposure of customer or business data, and potential disruption of the shopping service.

Technologies: [SourceCodester Simple and Nice Shopping Cart Script](https://junglewise.ai/threats/technologies/simple-and-nice-shopping-cart-script). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-14652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14652 being exploited in the wild.

**How severe is CVE-2026-14652?** High severity, with a CVSS score of 7.3, published 4 July 2026.

**Which products and versions are affected?** SourceCodester Simple and Nice Shopping Cart Script 1.0.

**Is there a fix for CVE-2026-14652?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14652 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14652?** Check whether you run SourceCodester Simple and Nice Shopping Cart Script at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in SourceCodester Simple and Nice Shopping Cart Script 1.0 within the '/admin/login.php' file. The 'username' POST parameter is not properly sanitized or validated before being used in a database query. A remote, unauthenticated attacker can exploit this using boolean-based or time-based blind SQL injection techniques to bypass authentication, extract sensitive information from the database, or modify data. Proof-of-concept exploits using sqlmap have been disclosed publicly. No official patch is currently available; developers are advised to use prepared statements with parameterized queries.

## Affected products

- SourceCodester Simple and Nice Shopping Cart Script 1.0

## Timeline

- 2026-06-03: disclosed: Vulnerability details and POC shared on GitHub by Yuesswor
- 2026-07-04: advisory: CVE published to NVD dataset

## References

- [https://github.com/Yuesswor/cve/issues/2](https://github.com/Yuesswor/cve/issues/2)
- [https://vuldb.com/cve/CVE-2026-14652](https://vuldb.com/cve/CVE-2026-14652)
- [https://vuldb.com/submit/846692](https://vuldb.com/submit/846692)
- [https://vuldb.com/vuln/376165](https://vuldb.com/vuln/376165)
- [https://vuldb.com/vuln/376165/cti](https://vuldb.com/vuln/376165/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Simple and Nice Shopping Cart Script SQL injection in userproductdeletequery.php](https://junglewise.ai/threats/cve-2026-15703-sourcecodester-simple-and-nice-shopping-cart-script-sql-injection)
- [SourceCodester Simple and Nice Shopping Cart Script SQL injection in login.php](https://junglewise.ai/threats/cve-2026-15190-sourcecodester-simple-and-nice-shopping-cart-script-sql-injection)
- [SourceCodester Simple and Nice Shopping Cart Script SQL injection in girlsproductdeletequery.php](https://junglewise.ai/threats/cve-2026-14654-sourcecodester-simple-and-nice-shopping-cart-script-sql-injection)
- [SourceCodester Simple and Nice Shopping Cart Script SQL injection in mensproductdeletequery.php](https://junglewise.ai/threats/cve-2026-14653-sourcecodester-simple-and-nice-shopping-cart-script-sql-injection)