CVE-2026-7267
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In SourceCodester Pizzafy Ecommerce System 1.0, manipulation of the ID argument in /view_prod.php leads to SQL injection. The attack can be carried out remotely, and a public exploit is available and may be used.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, risking data leakage, modification or deletion, and takeover of the application.
Recommendation
Apply a fix or replace the vulnerable component as soon as possible; meanwhile restrict access to /view_prod.php and enforce input validation and parameterized SQL queries.
Other vulnerabilities in Pizzafy Ecommerce System
See all- CVE-2026-7408Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_menu function of /admin/ajax.php?action=save_menu. Manipulation leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-7407Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_settings function of /pizzafy/admin/ajax.php?action=save_settings (Setting Handler). Manipulation leads to SQL injection. The attack can be launched remotely and the exploit is publicly disclosed.
- CVE-2026-7266Medium
In SourceCodester Pizzafy Ecommerce System 1.0, the save_order function in /admin/ajax.php?action=save_order is vulnerable to SQL injection via manipulation of the ID argument. The attack can be executed remotely, and the exploit is publicly available and may be used.
- CVE-2026-7264Medium
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0 in the get_cart_items function of /admin/ajax.php?action=get_cart_items, where manipulation of the ID argument leads to SQL injection. The attack may be launched remotely and the exploit has been made public.
Original NVD description (English source)
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS