CVE-2026-15190 is a SQL injection vulnerability affecting SourceCodester Simple and Nice Shopping Cart Script version 1.0. The flaw exists in the /login.php file where the Username parameter is not properly sanitized, enabling attackers to manipulate SQL queries. This can lead to unauthorized access or data manipulation. The vulnerability is remotely exploitable without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. No official fix or patch has been disclosed as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk to affected installations. However, the impact is rated medium due to limited details on the extent of data exposure or control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewalls or input validation controls to mitigate injection attempts. Monitoring for unusual database activity may help detect exploitation attempts.