Is there a public PoC exploit available for CVE-2026-14713?

Yes, a public proof-of-concept exploit is available for CVE-2026-14713. Prioritise patching immediately. EPSS: 0.3%.

Pizzafy E-Commerce System CVE-2026-14713

Q: What is the CVSS score of CVE-2026-14713?

CVE-2026-14713 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41728 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-w392-mcrm-ggqm

PHP SQLi Pizzafy E Commerce System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Network-accessible, no auth required per PR:N; SQLi allows full DB read (C:H) and write (I:H); availability impact is limited rather than total.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 06:22 vuln.today

CVSS changed

Jul 05, 2026 - 06:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Jul 05, 2026 - 05:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in SourceCodester Pizzafy E-Commerce System 1.0 exposes the application to unauthenticated remote database compromise via the id parameter in /admin/ajax.php?action=confirm_order. The CVSS 4.0 vector (PR:N) indicates the vulnerable admin endpoint is reachable without authentication, compounding the severity of the unsanitized input. A publicly available exploit exists on GitHub, though the product is not listed in the CISA KEV catalog and has a very limited production deployment footprint.

Technical ContextAI

Pizzafy E-Commerce System is a free PHP-based shopping cart application distributed by SourceCodester, a repository of open-source academic and demonstration scripts. The affected component is a PHP script (/admin/ajax.php) that handles AJAX-driven order confirmation actions. Per CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the application constructs SQL queries using unsanitized user-supplied input - specifically the id parameter - without parameterization or adequate escaping, allowing an attacker to alter query logic. The CPE string cpe:2.3:a:sourcecodester:pizzafy_e-commerce_system:*:*:*:*:*:*:*:* covers all known versions of the product. The absence of an authentication gate on an admin-facing AJAX endpoint is a secondary design flaw that elevates exploitability.

RemediationAI

No vendor-released patch has been identified at time of analysis - SourceCodester does not maintain a security patching lifecycle for its free script offerings. The primary remediation is to replace the vulnerable SQL query construction in /admin/ajax.php with parameterized queries or prepared statements using PHP PDO or MySQLi, which eliminates the injection vector entirely. As a compensating control, enforce HTTP authentication or session-based access control on all /admin/ paths, ensuring that ajax.php is not reachable by unauthenticated users - this addresses the secondary design flaw and limits the exploitable population even if the SQLi is not immediately fixed. Deploying a web application firewall (WAF) with SQL injection signatures provides an additional detection and blocking layer, though WAFs can be bypassed and should not be treated as a primary fix. Organizations running this software in any internet-facing capacity should consider replacing it with a maintained e-commerce platform, as no upstream security support exists. References: https://vuldb.com/cve/CVE-2026-14713, PoC at https://github.com/J4ng3ay/CVE/issues/1.