CVE-2026-14713 is a SQL injection vulnerability in SourceCodester Pizzafy E-Commerce System 1.0. The issue exists in the /admin/ajax.php?action=confirm_order script where the 'ID' parameter is not properly sanitized, enabling remote attackers to inject SQL commands. This vulnerability can be exploited without authentication and requires no user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction needed, with low confidentiality, integrity, and availability impacts. No vendor patch or official remediation has been disclosed as of the publication date.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the system's data. The medium severity score reflects limited but significant impact due to the low complexity and no required privileges for exploitation.

No official patch or remediation guidance is currently available from the vendor. Users of SourceCodester Pizzafy E-Commerce System 1.0 should consider implementing application-level input validation and SQL query parameterization as temporary mitigations. Monitor vendor channels for updates or official fixes. Restrict access to the vulnerable endpoint where possible until a patch is released.