Is there a public PoC exploit available for CVE-2026-7265?

Yes, a public proof-of-concept exploit is available for CVE-2026-7265. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce CVE-2026-7265

Q: What is the CVSS score of CVE-2026-7265?

CVE-2026-7265 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26031 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 11:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 11:15 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 11:00 euvd

EUVD-2026-26031

Analysis Generated

Apr 28, 2026 - 11:00 vuln.today

CVE Published

Apr 28, 2026 - 10:30 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to read, modify, or delete database contents through the ID parameter in the category function (pizza/index.php?page=category). The vulnerability has publicly available exploit code and requires valid user authentication to exploit, making it a moderate-risk issue suitable for immediate patching in production environments.

Technical ContextAI

The vulnerability exists in the PHP-based Pizzafy Ecommerce System's category management functionality. The file pizza/index.php processes the 'page=category' parameter and passes user-supplied 'ID' input directly into SQL queries without proper sanitization or parameterized query preparation. This classic SQL injection (CWE-89) attack vector allows attackers to inject arbitrary SQL commands. The CPE indicates all versions of SourceCodester Pizzafy Ecommerce System are affected. The CVSS vector shows network-accessible attack surface (AV:N) with low complexity (AC:L), but requires legitimate user authentication (PR:L), limiting the initial attack surface to authenticated users with account credentials.

RemediationAI

Contact SourceCodester at https://www.sourcecodester.com/ to obtain patched versions and security updates, as no specific patch version number is confirmed in available data. Immediately after applying patches, verify the SQL injection fix by testing the category function with SQL injection payloads (e.g., ID parameter containing single quotes or UNION-based injection attempts). If vendor patches are not immediately available, implement these compensating controls: (1) Apply input validation to the ID parameter using whitelist regex patterns accepting only numeric characters (side effect: may break legitimate numeric IDs with leading zeros, test thoroughly); (2) Enable Web Application Firewall (WAF) rules to block SQL injection patterns in GET parameters (side effect: may require tuning to avoid false positives on legitimate traffic); (3) Restrict network access to the pizza/index.php endpoint to authorized internal networks only using firewall rules (side effect: breaks public-facing ecommerce functionality, only viable for internal testing); (4) Enforce principle of least privilege on database user accounts used by the application, removing DELETE/ALTER TABLE permissions and limiting to SELECT/INSERT/UPDATE only (side effect: may break legitimate application features requiring schema modifications). References: https://vuldb.com/vuln/359916 for vulnerability details.