PT-2026-35663 · Sourcecodester · Pizzafy Ecommerce System

Fernando Mengali · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7226

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7226

Affected Products

Pizzafy Ecommerce System

References · 6

• 🔥 https://github.com/fernando-mengali/vulndb-submissions/blob/main/03-vul-SQLI.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7226 · Security Note
• https://vuldb.com/vuln/359826 · Note
• https://vuldb.com/submit/802413 · Note
• https://vuldb.com/vuln/359826/cti · Note
• https://sourcecodester.com · Note