CVE-2026-15703 is a SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0. The flaw exists in the /admin/userproductdeletequery.php file where the user_id parameter is not properly sanitized, enabling remote attackers to inject malicious SQL commands. This can lead to unauthorized database queries. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). There is no vendor advisory or patch available at this time, and the exploit code is publicly disclosed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The vulnerability affects the integrity and confidentiality of the database. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected script and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the user_id parameter.