CVE-2026-14692 identifies a SQL injection vulnerability in SourceCodester Multi-Vendor Online Grocery Management System versions 1.0 and 5.7.26. The flaw exists in the save_shop_type function of the classes/Master.php file, specifically in handling POST parameters. An attacker can remotely exploit this vulnerability by manipulating input to execute unauthorized SQL commands. The vulnerability has been publicly disclosed, but no official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without user interaction, increasing its risk. However, the CVSS score of 5.3 indicates a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity may also help detect exploitation attempts.