CVE-2026-14713

HighCVSS 7.3

Published: 05/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A security vulnerability has been discovered in SourceCodester Pizzafy E-Commerce System 1.0, specifically in the file /admin/ajax.php?action=confirm_order. The ID argument is susceptible to SQL injection, allowing remote attacks. The exploit has been publicly released.

Risk Assessment

The risk includes remote execution of unauthorized SQL queries, potentially leading to data breaches, database manipulation, or system compromise.

Recommendation

Immediately update the system to the latest version or apply a security patch. If not possible, restrict access to /admin/ajax.php and implement strict input validation.

Other vulnerabilities in SourceCodester Pizzafy E-Commerce System

CVE-2026-10704High
SQL Injection vulnerability in the administrative panel of SourceCodester Pizzafy E-Commerce System 1.0. The Login function in /admin/admin_class_novo.php allows manipulation of the Username argument, enabling remote SQL injection. The exploit is publicly available.

Original NVD description (English source)

A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.