CVE-2026-7408

MEDIUM

SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection

Title source: cna
STIX 2.1

Description

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

References (5)

Scores

CVSS v3 4.7
EPSS 0.0003
EPSS Percentile 7.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
SourceCodester/Pizzafy Ecommerce System 1.0
Published Apr 29, 2026
Tracked Since Apr 30, 2026