Which versions of Pizzafy E-Commerce System are affected by CVE-2026-10704?

SourceCodester Pizzafy E-Commerce System 1.0 contains an unauthenticated SQL injection vulnerability in the admin login module that allows direct bypass of administrative authentication controls.

Is there a public PoC exploit available for CVE-2026-10704?

Yes, a public proof-of-concept exploit is available for CVE-2026-10704. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10704?

Within 24 hours: Identify all internet-accessible Pizzafy 1.0 instances and document exposure scope. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking SQL injection patterns against /admin/admin_class_novo.php, restrict admin interface access to trusted IP ranges via network firewall, and enable detailed logging of all admin authentication attempts. Within 30 days: Migrate to a vendor-maintained e-commerce platform (WooCommerce with current patches, Shopify, or equivalent) and decommission Pizzafy 1.0.

Pizzafy E-Commerce System CVE-2026-10704

Q: What is the CVSS score of CVE-2026-10704?

CVE-2026-10704 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34063 MEDIUM

SQL Injection (CWE-89)

2026-06-03 VulDB

GHSA-cr37-3vx9-9f5f

PHP SQLi Pizzafy E Commerce System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 03, 2026 - 02:22 NVD

HIGH MEDIUM

CVSS changed

Jun 03, 2026 - 02:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 03, 2026 - 01:57 vuln.today

CVE Published

Jun 03, 2026 - 00:45 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy E-Commerce System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter sent to the Login function in /admin/admin_class_novo.php, compromising the administrative authentication flow. Publicly available exploit code exists per the referenced GitHub proof-of-concept, raising opportunistic exploitation risk despite the limited deployment footprint of this small-scale PHP e-commerce application. No KEV listing or EPSS score is provided, so exploitation appears opportunistic rather than confirmed active.

Technical ContextAI

Pizzafy E-Commerce System is a small PHP-based open-source web application distributed by SourceCodester, typically used as a learning project or for small-business pizza ordering sites. The vulnerable code resides in the Login function within /admin/admin_class_novo.php inside the Administrative Control Panel, where the Username argument is concatenated into a SQL query without proper parameterization, matching the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause. The affected CPE is cpe:2.3:a:sourcecodester:pizzafy_e-commerce_system:*:*:*:*:*:*:*:*, indicating all distributed versions (only 1.0 is referenced) of the product are in scope.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester projects are typically community-maintained and rarely receive coordinated security fixes, so operators should treat this as a self-remediation situation. As a code-level fix, replace the vulnerable concatenated query in the Login function of /admin/admin_class_novo.php with a prepared statement using PDO or mysqli parameter binding for the Username and Password inputs, which eliminates the injection class entirely. As compensating controls until a code fix is deployed, restrict access to the /admin/ directory at the web server level (Apache .htaccess or nginx location block) by source IP allowlist, place the admin panel behind a VPN or bastion, and deploy a WAF rule blocking SQLi patterns on /admin/admin_class_novo.php - these controls do not break legitimate front-end customer ordering but will block remote admin login from untrusted networks. Public POC details that may aid hardening are at https://github.com/nuiifornet/A033/blob/main/pizzafy-vulnerability.md and https://vuldb.com/vuln/368017.