CVE-2026-37149 identifies a SQL injection vulnerability (CWE-89) in version 1.0 of GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN. The flaw exists in the 'scost' parameter within the /grocery/search_products.php endpoint, enabling attackers to inject malicious SQL queries. This can lead to unauthorized disclosure of sensitive database information. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.7, reflecting local attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can result in unauthorized access to sensitive information stored in the database, compromising confidentiality and integrity. The vulnerability does not impact availability. The attack requires local access (AV:L) but no privileges or user interaction, making it a significant risk in environments where local access is possible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict local access to the affected system and consider implementing input validation or parameterized queries as a temporary mitigation to reduce risk.