Which versions of Pizzafy Ecommerce System are affected by CVE-2026-7227?

Pizzafy Ecommerce System 1.0 contains a critical SQL injection vulnerability in the admin login function that allows unauthenticated attackers to directly access and manipulate the database without…

Is there a public PoC exploit available for CVE-2026-7227?

Yes, a public proof-of-concept exploit is available for CVE-2026-7227. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7227?

Within 24 hours: Isolate all Pizzafy 1.0 instances from internet access or disable the /admin/ajax.php endpoint; audit database access logs for suspicious activity. Within 7 days: Contact Pizzafy vendor for patch availability and timeline; implement Web Application Firewall (WAF) rules to block SQL injection patterns in the email parameter of /admin/ajax.php?action=login. Within 30 days: Upgrade to patched version if available, or decommission Pizzafy 1.0 and migrate to a supported alternative ecommerce platform.

Pizzafy Ecommerce System CVE-2026-7227

Q: What is the CVSS score of CVE-2026-7227?

CVE-2026-7227 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25991 MEDIUM

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 28, 2026 - 06:22 NVD

HIGH MEDIUM

CVSS changed

Apr 28, 2026 - 06:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25991

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 05:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manipulation of the argument e-mail results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in Pizzafy Ecommerce System 1.0 allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the email parameter in the admin login function. The vulnerability exists in /admin/ajax.php?action=login and has a publicly available proof-of-concept exploit on GitHub. With CVSS 7.3 (High) and confirmed POC, this represents an immediate risk to internet-exposed admin panels, though no active exploitation has been confirmed by CISA KEV at time of analysis.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) affecting a PHP-based ecommerce application. The admin authentication endpoint (/admin/ajax.php?action=login) fails to properly sanitize or parameterize the email input parameter before including it in SQL queries. According to the CPE string (cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system), this affects SourceCodester's Pizzafy Ecommerce System. SQL injection occurs when user-controlled data is directly concatenated into SQL statements, allowing attackers to break out of the intended query logic and execute arbitrary SQL commands against the backend database. The CVSS vector indicates network-accessible exploitation (AV:N) with low attack complexity (AC:L), meaning no special conditions or timing are required beyond network access to the vulnerable endpoint.

RemediationAI

No vendor-released patch identified at time of analysis for this open-source project. Organizations running Pizzafy Ecommerce System 1.0 should immediately implement input validation and parameterized queries for the email parameter in /admin/ajax.php?action=login. Specifically, replace any string concatenation in SQL queries with prepared statements using PDO or mysqli parameterized query methods in PHP (e.g., $stmt->bind_param()). As compensating controls until code fixes are deployed: restrict access to /admin/ directory via IP allowlisting in web server configuration (Apache .htaccess or nginx location blocks) to only trusted administrator source IPs; implement a web application firewall (WAF) with SQL injection signature detection targeting the email parameter (note: may cause false positives if legitimate emails contain SQL-like characters); enable database query logging to detect injection attempts post-compromise. Long-term, consider migrating to a maintained ecommerce platform with active security support, as SourceCodester projects are often educational code samples rather than production-hardened applications.