CVE-2026-7408
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_menu function of /admin/ajax.php?action=save_menu. Manipulation leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
Potential SQL injection via the save_menu function may lead to data disclosure or modification. The public exploit increases the risk of exploitation.
Recommendation
Update the application to a fixed version or implement input validation and parameterized queries. Restrict access to the administrative panel.
Other vulnerabilities in Pizzafy Ecommerce System
See all- CVE-2026-7407Medium
A vulnerability was detected in Pizzafy Ecommerce System 1.0 in the save_settings function of /pizzafy/admin/ajax.php?action=save_settings (Setting Handler). Manipulation leads to SQL injection. The attack can be launched remotely and the exploit is publicly disclosed.
- CVE-2026-7267Medium
In SourceCodester Pizzafy Ecommerce System 1.0, manipulation of the ID argument in /view_prod.php leads to SQL injection. The attack can be carried out remotely, and a public exploit is available and may be used.
- CVE-2026-7266Medium
In SourceCodester Pizzafy Ecommerce System 1.0, the save_order function in /admin/ajax.php?action=save_order is vulnerable to SQL injection via manipulation of the ID argument. The attack can be executed remotely, and the exploit is publicly available and may be used.
- CVE-2026-7264Medium
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0 in the get_cart_items function of /admin/ajax.php?action=get_cart_items, where manipulation of the ID argument leads to SQL injection. The attack may be launched remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS