CVE-2026-14639 describes a SQL injection vulnerability in CodeAstro Ecommerce Website version 1.0. The issue arises from improper sanitization of the c_name parameter in the /ecommerce-website-php/customer/my_account.php?edit_account endpoint. This allows an attacker to inject malicious SQL code remotely, potentially impacting the confidentiality, integrity, and availability of the backend database. The vulnerability has been publicly disclosed but lacks an official fix or patch from the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium based on the CVSS score of 5.3, reflecting limited but non-negligible consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. As a temporary measure, applying input validation and sanitization on the c_name parameter may reduce risk. Avoid exposing the vulnerable endpoint unnecessarily until a fix is released.