CVE-2026-14691 is a code injection vulnerability affecting SourceCodester Multi-Vendor Online Grocery Management System version 1.0. The issue exists in the update_settings_info function of the Setting Handler component (classes/SystemSettings.php), where improper handling of the content[] argument allows remote attackers to inject code. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and low privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability allows remote attackers to inject and execute arbitrary code on the affected system, potentially compromising the integrity and availability of the application. Given the medium CVSS score (5.3), the impact is significant but not critical. There is no evidence of widespread exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected function or system, apply web application firewall rules to detect and block suspicious input targeting the content[] parameter, and monitor for unusual activity related to this component. Avoid deploying the vulnerable version in exposed environments if possible.