CVE-2026-14799: CodeAstro Ecommerce Website my_account.php sql injection
A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/myaccount.php?mywishlist. The manipulation of the argument deletewishlist results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14799?
CVE-2026-14799 has a medium severity rating of 6.3.
How does CVE-2026-14799 affect the CodeAstro Ecommerce Website?
CVE-2026-14799 allows for SQL injection through the my_account.php file via the delete_wishlist parameter.
Can the SQL injection in CVE-2026-14799 be exploited remotely?
Yes, the SQL injection vulnerability in CVE-2026-14799 can be exploited by attackers remotely.
What versions of CodeAstro Ecommerce Website are affected by CVE-2026-14799?
CVE-2026-14799 affects CodeAstro Ecommerce Website version 1.0.
How can I mitigate CVE-2026-14799?
To mitigate CVE-2026-14799, ensure proper input validation and use prepared statements to prevent SQL injection.