PT-2026-36016 · Sourcecodester · Pizzafy Ecommerce System

R3Ng4F · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7410

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add to cart. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-7410

Affected Products

Pizzafy Ecommerce System

References · 5

• 🔥 https://github.com/r3ng4f/Pizzafy_1/blob/main/04-exploit.md · Exploit
• https://vuldb.com/vuln/360144/cti · Note
• https://vuldb.com/vuln/360144 · Note
• https://sourcecodester.com · Note
• https://vuldb.com/submit/803625 · Note