Stored cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows a remote attacker with administrative credentials to inject arbitrary JavaScript via the Name parameter in the save_user function at /admin/ajax.php?action=save_user. A public proof-of-concept has been disclosed by researcher joaodrmmd (VulDB #359957), though EPSS at 0.03% (9th percentile) and a CVSS 4.0 score of 1.9 reflect the high-privilege prerequisite that significantly constrains real-world exploitation. No active exploitation has been confirmed and this vulnerability is not listed in CISA KEV.
Cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows a network-reachable attacker with admin-level credentials to inject malicious JavaScript via the `first_name` parameter in the `/admin/ajax.php?action=save_order` endpoint. Exploitation further requires a second admin user to interact with the affected order data before the payload executes, as confirmed by PR:H and UI:P in the CVSS 4.0 vector. A public proof-of-concept exists (PDF report on GitHub), but with an EPSS of 0.03% and no CISA KEV listing, real-world exploitation probability is minimal.
Reflected cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID parameter in /index.php?page=product, requiring user interaction to trigger payload execution. CVSS 4.8 with public exploit code availability (E:P) indicates low immediate risk despite network accessibility, constrained by high privilege requirement (PR:H) and user interaction dependency (UI:P).
Insecure deserialization in Grav CMS FileCache exposes low-privilege authenticated users to PHP object injection through the `FileCache::doGet()` method, which calls `unserialize()` with `['allowed_classes' => true]` on cache file contents without integrity verification. Versions 1.7.44 through 1.7.49.5 and 2.0.0-beta.0/beta.1 are affected; the component is not on Grav's default cache path but is reachable by plugins and downstream consumers. Publicly available exploit code exists demonstrating the deserialization primitive, though no active exploitation is recorded in CISA KEV and EPSS sits at 0.05%, reflecting negligible widespread exploitation risk.