PT-2026-35813 · Sourcecodester · Pizzafy Ecommerce System

Fernando Mengali · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7293

NVD

CVSS v2.0

5.8

Medium

AV:N/AC:L/Au:M/C:P/I:P/A:P

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete category of the file /admin/ajax.php?action=delete category. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-7293

Affected Products

Pizzafy Ecommerce System

References · 8

• 🔥 https://github.com/fernando-mengali/vulndb-submissions/blob/main/11-vul-SQLI.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7293 · Security Note
• https://vuldb.com/submit/802466 · Note
• https://twitter.com/CVEnew/status/2049227554431578402 · Twitter Post
• https://vuldb.com/vuln/359953/cti · Note
• https://sourcecodester.com · Note
• https://vuldb.com/vuln/359953 · Note
• https://twitter.com/VulmonFeeds/status/2049250264872280373 · Twitter Post