CVE-2026-7407
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_settings function of /pizzafy/admin/ajax.php?action=save_settings (Setting Handler). Manipulation leads to SQL injection. The attack can be launched remotely and the exploit is publicly disclosed.
Risk Assessment
Potential SQL injection via the save_settings function may result in data disclosure or modification. The public exploit increases the risk.
Recommendation
Update the application to a fixed version or implement input validation and parameterized queries. Restrict access to the administrative panel.
Other vulnerabilities in Pizzafy Ecommerce System
See all- CVE-2026-7408Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_menu function of /admin/ajax.php?action=save_menu. Manipulation leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-7267Medium
In SourceCodester Pizzafy Ecommerce System 1.0, manipulation of the ID argument in /view_prod.php leads to SQL injection. The attack can be carried out remotely, and a public exploit is available and may be used.
- CVE-2026-7266Medium
In SourceCodester Pizzafy Ecommerce System 1.0, the save_order function in /admin/ajax.php?action=save_order is vulnerable to SQL injection via manipulation of the ID argument. The attack can be executed remotely, and the exploit is publicly available and may be used.
- CVE-2026-7264Medium
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0 in the get_cart_items function of /admin/ajax.php?action=get_cart_items, where manipulation of the ID argument leads to SQL injection. The attack may be launched remotely and the exploit has been made public.
Original NVD description (English source)
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /pizzafy/admin/ajax.php?action=save_settings of the component Setting Handler. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS