CVE-2026-10704

HighCVSS 7.3

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

SQL Injection vulnerability in the administrative panel of SourceCodester Pizzafy E-Commerce System 1.0. The Login function in /admin/admin_class_novo.php allows manipulation of the Username argument, enabling remote SQL injection. The exploit is publicly available.

Risk Assessment

An attacker can gain unauthorized access to the database, steal customer and order data, and potentially take control of the system.

Recommendation

Immediately update the system to the latest version or apply a patch to prevent SQL injection (e.g., parameterized queries).

Other vulnerabilities in SourceCodester Pizzafy E-Commerce System

CVE-2026-14713High
A security vulnerability has been discovered in SourceCodester Pizzafy E-Commerce System 1.0, specifically in the file /admin/ajax.php?action=confirm_order. The ID argument is susceptible to SQL injection, allowing remote attacks. The exploit has been publicly released.

Original NVD description (English source)

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.