CVE-2026-14691 is a code injection vulnerability affecting SourceCodester Multi-Vendor Online Grocery Management System version 1.0. The issue resides in the update_settings_info function of the Setting Handler component (file classes/SystemSettings.php). An attacker can remotely manipulate the content[] argument to inject arbitrary code. The vulnerability has been publicly disclosed, carries a CVSS 4.0 score of 5.3 (medium severity), and no official fix or patch has been identified in the vendor advisory or other sources.

Successful exploitation of this vulnerability could allow an attacker with low privileges to remotely inject and execute arbitrary code within the affected system. This could lead to unauthorized actions or compromise of the system integrity. However, the impact is rated medium due to limited privileges required and other vector factors in the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected function and monitor for suspicious activity related to update_settings_info. Avoid exposing the vulnerable system to untrusted networks where possible.