CVE-2026-75014 is a SQL injection flaw (CWE-89) in SourceCodester Pet Grooming Management Software 1.0, in the file /admin/get_barcode_data.php. The record rates it High at 7.3 and says an exploit has been published. We could not confirm a fixed version, so restrict access and check the vendor.
What's affected
The record says SourceCodester Pet Grooming Management Software version 1.0 is affected, through the barcode argument of the file /admin/get_barcode_data.php. It says the attack may be started remotely and that the exploit has been published and may be used. We read the public issue that describes the problem and did not find a vendor patch or fixed version in the sources.
SourceCodester distributes sample and educational PHP applications, and many of them are not maintained like commercial products. If you use this software for a real business, assume that a patch may never arrive.
The record scores it 7.3 (High): network access, low complexity, no privileges and low impact on each of confidentiality, integrity and availability. The record's CWE list includes both CWE-74 and CWE-89.
How to check if you're exposed
Check whether you run this application and where it is reachable.
find / -name get_barcode_data.php 2>/dev/null
Look at your web server access logs for requests to that path from addresses you do not recognise. Also check whether the application is reachable from the internet at all, since a grooming shop's booking tool rarely needs to be. Review the database account the application uses, because the damage from a SQL injection is bounded by that account's rights.
What to do now
- Take the application off the public internet, or put it behind a VPN or an allowlist of trusted addresses.
- Block or restrict the /admin/ path at the web server until a fix is available.
- Reduce the database account used by the application to the minimum rights it needs.
- Back up the database now, and keep a copy off the server.
- Ask the vendor or maintainer for a fix, or plan a move to a maintained product if none is available.
Why it matters
The weakness is SQL injection, CWE-89, which is a form of injection, CWE-74. The application takes the barcode value from the request and uses it in a database query without separating data from code. Anyone who can send that request can then influence the query. The standard fix is to use prepared statements with bound parameters, which treat the value as data under all circumstances.
SQL injection is one of the oldest and best understood flaw types, and it still turns up in small applications because they are written without a review. Customer lists, appointments and contact details are held in this database, so a leak has privacy consequences even for a small business. The record's KEV flag is false, but it also says the exploit is public, so scanning for it is likely.
Quick check
Is there a patch?
We could not confirm one in the record or the sources. Check with the vendor, and use the access limits above in the meantime.
Why is it rated High if the impact values are low?
The vector has network access, low complexity and no privileges needed, with a low impact on all three of confidentiality, integrity and availability, which gives 7.3.
Sources
Last reviewed: 18 October 2026.
