PT-2026-35823 · Sourcecodester · Pizzafy Ecommerce System

R3Du · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7297

NVD

CVSS v2.0

3.3

Low

AV:N/AC:L/Au:M/C:N/I:P/A:N

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function save user of the file /admin/ajax.php?action=save user. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-7297

Affected Products

Pizzafy Ecommerce System

References · 7

• 🔥 https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Users.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7297 · Security Note
• https://vuldb.com/submit/803176 · Note
• https://vuldb.com/vuln/359957/cti · Note
• https://sourcecodester.com · Note
• https://vuldb.com/vuln/359957 · Note
• https://twitter.com/CVEnew/status/2049227488711020996 · Twitter Post