The vulnerability CVE-2026-14654 affects SourceCodester Simple and Nice Shopping Cart Script 1.0. It is a SQL injection flaw in an unspecified function within the /admin/girlsproductdeletequery.php file. Manipulating the user_id parameter allows an attacker to inject SQL code remotely without requiring privileges or user interaction. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). There is no vendor advisory or patch information available, and no known exploits are reported in the wild at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. Since the attack vector is network accessible and requires no privileges or user interaction, the risk is significant. However, the CVSS vector indicates low to low impact on confidentiality, integrity, and availability, suggesting some limitations in the exploitability or impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /admin/girlsproductdeletequery.php endpoint and validate or sanitize the user_id parameter input to mitigate injection risks. Monitor for vendor updates or community patches addressing this vulnerability.