Is there a public PoC exploit available for CVE-2026-7267?

Yes, a public proof-of-concept exploit is available for CVE-2026-7267. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce System CVE-2026-7267

Q: What is the CVSS score of CVE-2026-7267?

CVE-2026-7267 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26033 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 11:45 euvd

EUVD-2026-26033

Analysis Generated

Apr 28, 2026 - 11:45 vuln.today

CVE Published

Apr 28, 2026 - 11:00 nvd

LOW 2.1

DescriptionCVE.org

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 via the ID parameter in /view_prod.php allows authenticated remote attackers to execute arbitrary SQL queries with low complexity and no user interaction required. The vulnerability has a publicly available exploit and CVSS score of 6.3 reflecting moderate impact on confidentiality, integrity, and availability. Active exploitation is not yet confirmed in CISA KEV, but public proof-of-concept code exists.

Technical ContextAI

The vulnerability exists in the PHP-based Pizzafy Ecommerce System, specifically within the /view_prod.php file which appears to handle product viewing functionality. The ID parameter is passed to a database query without proper sanitization or parameterized query protection, creating a classic SQL injection vulnerability classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). An authenticated attacker can manipulate the ID parameter to inject arbitrary SQL syntax, potentially allowing them to read, modify, or delete database contents depending on database permissions and backend SQL engine behavior.

RemediationAI

Vendor patch information is not confirmed in available data; contact SourceCodester directly via https://www.sourcecodester.com/ to inquire about patched versions or security updates. Immediate compensating controls include: implement prepared statements or parameterized queries for all database interactions in /view_prod.php to prevent SQL injection regardless of input; restrict database user permissions to read-only access where possible to limit data exfiltration and modification; deploy a Web Application Firewall (WAF) with SQL injection detection rules to block common injection patterns such as UNION, EXEC, DROP, or SELECT statements in the ID parameter; enforce strict input validation on the ID parameter to accept only expected formats (e.g., numeric values if product IDs are integers), rejecting any requests containing SQL metacharacters or unusual encoding; audit database logs for suspicious queries and audit application logs for repeated failed or anomalous requests to the /view_prod.php endpoint. Monitor the SourceCodester website and security mailing lists for official patches.