CVE-2026-14653 is a SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0. The flaw exists in an unspecified function within /admin/mensproductdeletequery.php, where the user_id parameter is not properly sanitized, enabling attackers to inject malicious SQL code. This vulnerability can be exploited remotely without any privileges or user interaction. The vulnerability was publicly disclosed and is assigned a CVSS 4.0 base score of 6.9, indicating medium severity. No vendor advisory or patch information is available, and the remediation level is unknown.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the affected system's data. The vulnerability does not require authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the user_id parameter in /admin/mensproductdeletequery.php to prevent SQL injection. Restricting database permissions and using prepared statements or parameterized queries can also mitigate the risk.