CVE-2026-7268
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to SQL injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion in the database.
Recommendation
Apply a fix or implement input validation and parameterized queries; consider restricting access to the admin panel.
Other vulnerabilities in SourceCodester Pizzafy Ecommerce System
See all- CVE-2026-16226Medium
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0, where the save_settings function in /admin/admin_class_novo.php fails to properly validate the img argument, allowing unrestricted file upload. The attack can be performed remotely.
- CVE-2026-10559Medium
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /index.php allows remote file inclusion via the page argument. The exploit has been published.
- CVE-2026-10558Medium
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /admin/index.php allows remote file inclusion via the page argument. The exploit is now public.
- CVE-2026-8117Medium
A cross-site scripting vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/index.php. Manipulation of the page argument allows injection of malicious script. The attack can be launched remotely and a public exploit is already available.
- CVE-2026-7410Medium
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_to_cart. The manipulation of the argument pid leads to SQL injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-7409Medium
A flaw was found in SourceCodester Pizzafy Ecommerce System 1.0 in the save_user function of /admin/ajax.php?action=save_user. Manipulation leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-7394Medium
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in /admin/view_order.php where manipulation of the ID argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-7393Medium
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the save_menu function of the file /admin/admin_class_novo.php (File Extension Handler component). Manipulation of the img argument results in unrestricted upload. The attack is possible remotely and the exploit has been made public.
- CVE-2026-7297Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_user via manipulation of the Name argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-7296Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_order via manipulation of the first_name argument. The attack can be executed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS