Pizzafy Ecommerce System CVE-2026-7296

Q: What is the CVSS score of CVE-2026-7296?

CVE-2026-7296 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26146 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 cna@vuldb.com

PHP XSS

1.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin credentials required (PR:H) and victim admin must view injected content (UI:R); XSS with scope change yields C:L/I:L, no availability impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:09 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

4.8 (MEDIUM) 1.9 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 22:22 euvd

EUVD-2026-26146

CVE Published

Apr 28, 2026 - 22:16 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_order of the file /admin/ajax.php?action=save_order. Performing a manipulation of the argument first_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

AnalysisAI

Cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows a network-reachable attacker with admin-level credentials to inject malicious JavaScript via the first_name parameter in the /admin/ajax.php?action=save_order endpoint. Exploitation further requires a second admin user to interact with the affected order data before the payload executes, as confirmed by PR:H and UI:P in the CVSS 4.0 vector. A public proof-of-concept exists (PDF report on GitHub), but with an EPSS of 0.03% and no CISA KEV listing, real-world exploitation probability is minimal.

Technical ContextAI

The vulnerability resides in the PHP-based AJAX handler /admin/ajax.php within SourceCodester Pizzafy Ecommerce System 1.0, specifically the save_order function. The first_name parameter submitted during order creation is insufficiently sanitized before being stored or reflected within the administrative interface, satisfying the definition of CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting). The CVSS 4.0 vector assigns VI:L with no confidentiality or availability impact, consistent with a stored or reflected XSS that is limited to integrity manipulation within the admin panel context. No CPE string was included in the source data; the affected product is identified solely through NVD and EUVD-2026-26146 references to version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary recommended fix is to apply strict output encoding to the first_name parameter within the save_order function in /admin/ajax.php - specifically, wrapping any rendered output in PHP's htmlspecialchars() with ENT_QUOTES and UTF-8 to neutralize injected markup before display. As a compensating control, access to the /admin/ directory should be restricted at the network or web server level to trusted IP ranges only, which reduces the attacker surface for credential-based abuse; the trade-off is reduced administrative flexibility for remote teams. Content Security Policy (CSP) headers on admin pages can further limit script execution impact even if injection occurs. The VulDB advisory is at https://vuldb.com/vuln/359956 and the public POC report is at https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Orders.pdf.