CVE-2026-14652 describes a SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0. The issue exists in the Admin Login component within the /admin/login.php file, where the Username parameter is not properly sanitized, allowing an attacker to inject SQL code remotely. The vulnerability has been publicly disclosed with a CVSS 4.0 score of 6.9 (medium severity). No official fix or patch is currently available, and the vendor has not provided remediation details. While exploit code is public, there are no confirmed active exploits in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the Username parameter in the admin login page. This could lead to unauthorized data access, data modification, or authentication bypass depending on the database and application context. The vulnerability is remotely exploitable without authentication and requires no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and parameterized queries on the Username parameter to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.