Skip to main content

Pizzafy Ecommerce System CVE-2026-7226

| EUVD-2026-25990 MEDIUM
SQL Injection (CWE-89)
2026-04-28 VulDB
PHP SQLi
5.5
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

8
CVSS changed
Apr 29, 2026 - 01:12 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
PoC Detected
Apr 29, 2026 - 01:00 vuln.today
Public exploit code
Severity Changed
Apr 28, 2026 - 06:22 NVD
HIGH MEDIUM
CVSS changed
Apr 28, 2026 - 06:22 NVD
7.3 (HIGH) 6.9 (MEDIUM)
Analysis Generated
Apr 28, 2026 - 06:01 vuln.today
EUVD ID Assigned
Apr 28, 2026 - 05:30 euvd
EUVD-2026-25990
Analysis Generated
Apr 28, 2026 - 05:30 vuln.today
CVE Published
Apr 28, 2026 - 04:45 nvd
MEDIUM 5.5

DescriptionNVD

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability through the login2 function. The vulnerability exists in /admin/ajax.php when processing the email parameter during administrative login, enabling attackers to bypass authentication, extract sensitive data, modify records, or disrupt service. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: identify all instances of Pizzafy 1.0 in production and isolate affected systems from internet-facing access or disable admin login functionality. Within 7 days: contact SourceCodester for patch availability and timeline; implement Web Application Firewall rules to block SQL injection patterns in /admin/ajax.php email parameter; conduct database audit for unauthorized access. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-7226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy