PT-2026-35709 · Sourcecodester · Pizzafy Ecommerce System

Fernando Mengali · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7265

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Pizzafy Ecommerce System version 1.0

Description An issue exists where the manipulation of the ID argument in the 'Category' function of the 'pizza/index.php?page=category' endpoint allows for SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution. This allows for remote exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7265

Affected Products

Pizzafy Ecommerce System

References · 10

• 🔥 https://github.com/fernando-mengali/vulndb-submissions/blob/main/07-vul-SQLI.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7265 · Security Note
• https://vuldb.com/vuln/359916/cti · Note
• https://sourcecodester.com · Note
• https://vuldb.com/submit/802438 · Note
• https://t.me/cveNotify/161234 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049093567071596893 · Twitter Post
• https://t.me/CVEtracker/52077 · Telegram Post
• https://vuldb.com/vuln/359916 · Note
• https://twitter.com/CVEnew/status/2049227570600722476 · Twitter Post