CVE-2026-10558
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /admin/index.php allows remote file inclusion via the page argument. The exploit is now public.
Risk Assessment
An attacker can read sensitive files on the server or execute malicious code by including a file containing scripts.
Recommendation
Upgrade the system to the latest version or apply proper input filtering for the page parameter.
Other vulnerabilities in SourceCodester Pizzafy Ecommerce System
See all- CVE-2026-16226Medium
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0, where the save_settings function in /admin/admin_class_novo.php fails to properly validate the img argument, allowing unrestricted file upload. The attack can be performed remotely.
- CVE-2026-10559Medium
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /index.php allows remote file inclusion via the page argument. The exploit has been published.
- CVE-2026-7297Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_user via manipulation of the Name argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-7296Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_order via manipulation of the first_name argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-7295Low
SourceCodester Pizzafy Ecommerce System 1.0 is vulnerable to XSS in the save_menu function of /admin/ajax.php?action=save_menu via the Name argument. The attack is remote and the exploit is public.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument page results in file inclusion. The attack is possible to be carried out remotely. The exploit is now public and may be used.