PT-2026-35822 · Sourcecodester · Pizzafy Ecommerce System

R3Du · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7296

NVD

CVSS v2.0

3.3

Low

AV:N/AC:L/Au:M/C:N/I:P/A:N

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save order of the file /admin/ajax.php?action=save order. Performing a manipulation of the argument first name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7296

Affected Products

Pizzafy Ecommerce System

References · 6

• 🔥 https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Orders.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7296 · Security Note
• https://vuldb.com/vuln/359956/cti · Note
• https://vuldb.com/submit/803175 · Note
• https://vuldb.com/vuln/359956 · Note
• https://sourcecodester.com · Note