CVE-2026-7295
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
SourceCodester Pizzafy Ecommerce System 1.0 is vulnerable to XSS in the save_menu function of /admin/ajax.php?action=save_menu via the Name argument. The attack is remote and the exploit is public.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the admin context, potentially leading to admin panel takeover or data theft.
Recommendation
Update the system to the latest version or apply input filtering in the save_menu function.
Other vulnerabilities in SourceCodester Pizzafy Ecommerce System
See all- CVE-2026-16226Medium
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0, where the save_settings function in /admin/admin_class_novo.php fails to properly validate the img argument, allowing unrestricted file upload. The attack can be performed remotely.
- CVE-2026-10559Medium
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /index.php allows remote file inclusion via the page argument. The exploit has been published.
- CVE-2026-10558Medium
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. An unknown function in /admin/index.php allows remote file inclusion via the page argument. The exploit is now public.
- CVE-2026-7297Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_user via manipulation of the Name argument. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-7296Low
A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_order via manipulation of the first_name argument. The attack can be executed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS