PT-2026-35814 · Sourcecodester · Pizzafy Ecommerce System

R3Du · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7294

Mitre

CVSS v3.1

2.4

Low

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save settings of the file /admin/index.php?page=save settings. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7294

Affected Products

Pizzafy Ecommerce System

References · 8

• 🔥 https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Config.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7294 · Security Note
• https://vuldb.com/vuln/359954 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/submit/803172 · Note
• https://twitter.com/VulmonFeeds/status/2049257943976001604 · Twitter Post
• https://twitter.com/CVEnew/status/2049227549134238013 · Twitter Post
• https://vuldb.com/vuln/359954/cti · Note