CVE-2026-7266

MEDIUM

SourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action=save_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

References (5)

Scores

CVSS v3 6.3
EPSS 0.0003
EPSS Percentile 7.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
SourceCodester/Pizzafy Ecommerce System 1.0
Published Apr 28, 2026
Tracked Since Apr 28, 2026