PT-2026-36015 · Sourcecodester · Pizzafy Ecommerce System

R3Ng4F · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7409

NVD

CVSS v2.0

5.8

Medium

AV:N/AC:L/Au:M/C:P/I:P/A:P

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save user of the file /admin/ajax.php?action=save user. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7409

Affected Products

Pizzafy Ecommerce System

References · 6

• 🔥 https://github.com/r3ng4f/Pizzafy_1/blob/main/03-exploit.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7409 · Security Note
• https://vuldb.com/submit/803624 · Note
• https://vuldb.com/vuln/360143 · Note
• https://vuldb.com/vuln/360143/cti · Note
• https://sourcecodester.com · Note