Is there a public PoC exploit available for CVE-2026-7393?

Yes, a public proof-of-concept exploit is available for CVE-2026-7393. Prioritise patching immediately. EPSS: 0.0%.

Pizzafy Ecommerce System CVE-2026-7393

Q: What is the CVSS score of CVE-2026-7393?

CVE-2026-7393 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26265 LOW

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-29 VulDB

PHP File Upload Pizzafy Ecommerce System Sourcecodester

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin authentication required (PR:H); scope changes to OS layer via webshell RCE (S:C); full C/I/A impact on server confirmed by public POC.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:39 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 17:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 17:15 euvd

EUVD-2026-26265

CVE Published

Apr 29, 2026 - 17:00 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file /admin/admin_class_novo.php of the component File Extension Handler. Performing a manipulation of the argument img results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the img argument in the save_menu function of /admin/admin_class_novo.php, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.

Technical ContextAI

The vulnerability is rooted in CWE-434 (Unrestricted Upload of File with Dangerous Type): the PHP-based save_menu function within /admin/admin_class_novo.php accepts file uploads via the img parameter without enforcing a server-side extension allowlist, MIME-type validation, or content inspection. This allows an attacker to upload a .php file disguised as an image, which the web server will subsequently execute as PHP. The affected product is identified by CPE cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:*, version 1.0. SourceCodester distributes hobbyist and student-oriented PHP applications; this specific handler is part of the admin menu management interface. The vulnerability is a classical PHP unrestricted upload pattern where lack of server-side file type enforcement combined with a web-accessible upload directory creates a direct RCE primitive.

RemediationAI

No vendor-released patch has been identified for Pizzafy Ecommerce System 1.0 at the time of analysis. Operators should immediately apply a strict server-side file extension allowlist to the img upload parameter in save_menu within /admin/admin_class_novo.php, permitting only image extensions such as .jpg, .jpeg, .png, and .gif - client-side validation alone is insufficient. File content should be validated against its actual binary signature (magic bytes), not just the declared extension. Uploaded files must be stored outside the web root or in a directory where PHP execution is explicitly disabled via .htaccess (Options -ExecCGI, php_flag engine off) or server configuration, preventing execution of any uploaded payload even if extension filtering is bypassed. Admin panel access should be restricted to trusted IP ranges at the network or web server level where operationally feasible, reducing the effective attack surface given the PR:H requirement. Given the product's educational/hobbyist nature and apparent lack of active maintenance, replacing it with an actively maintained e-commerce platform is strongly advisable for any production environment. See VulDB advisory: https://vuldb.com/vuln/360118.