CVE-2026-7266
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In SourceCodester Pizzafy Ecommerce System 1.0, the save_order function in /admin/ajax.php?action=save_order is vulnerable to SQL injection via manipulation of the ID argument. The attack can be executed remotely, and the exploit is publicly available and may be used.
Risk Assessment
A remote attacker can execute arbitrary SQL queries in the application context, risking data confidentiality and integrity breaches and system takeover.
Recommendation
Immediately apply a fix or isolate the vulnerable endpoint; use parameterized queries and validate the ID argument.
Other vulnerabilities in Pizzafy Ecommerce System
See all- CVE-2026-7408Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_menu function of /admin/ajax.php?action=save_menu. Manipulation leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-7407Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_settings function of /pizzafy/admin/ajax.php?action=save_settings (Setting Handler). Manipulation leads to SQL injection. The attack can be launched remotely and the exploit is publicly disclosed.
- CVE-2026-7267Medium
In SourceCodester Pizzafy Ecommerce System 1.0, manipulation of the ID argument in /view_prod.php leads to SQL injection. The attack can be carried out remotely, and a public exploit is available and may be used.
- CVE-2026-7264Medium
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0 in the get_cart_items function of /admin/ajax.php?action=get_cart_items, where manipulation of the ID argument leads to SQL injection. The attack may be launched remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action=save_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS