Is there a public PoC exploit available for CVE-2026-7394?

Yes, a public proof-of-concept exploit is available for CVE-2026-7394. Prioritise patching immediately. EPSS: 0.0%.

Pizzafy Ecommerce System CVE-2026-7394

Q: What is the CVSS score of CVE-2026-7394?

CVE-2026-7394 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26266 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi Pizzafy Ecommerce System Sourcecodester

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.8 LOW

Admin credentials required (PR:H, AC:L); SQL injection enables partial data read and write (C:L/I:L) but no demonstrated availability impact on this view endpoint.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:38 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 18:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 18:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 18:00 euvd

EUVD-2026-26266

CVE Published

Apr 29, 2026 - 17:15 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the id GET parameter in /admin/view_order.php, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.

Technical ContextAI

The affected component is /admin/view_order.php within Pizzafy Ecommerce System 1.0, a PHP-based e-commerce application distributed by SourceCodester - a platform known for distributing open-source academic and hobbyist web projects. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command): the id GET parameter is concatenated directly into a SQL query without parameterized statements or input sanitization, enabling classic SQL injection. CPE cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:* identifies version 1.0 as the confirmed affected release. The PHP/MySQL stack typical of SourceCodester projects makes this susceptible to UNION-based or error-based injection techniques, as demonstrated by the public POC.

RemediationAI

No vendor-released patched version has been identified at the time of analysis; SourceCodester has not published an official fix or advisory for this issue. The primary long-term fix is for developers to replace raw SQL string construction in /admin/view_order.php with PHP PDO or MySQLi prepared statements with bound parameters, which eliminates the injection vector entirely. As an immediate compensating control, restrict access to the /admin/ directory at the web server level using IP allowlisting (e.g., Apache Require ip or nginx allow/deny directives), limiting exposure to trusted management networks - note this disrupts legitimate remote admin access. Deploying a WAF rule to block SQL metacharacters (single quotes, UNION, SELECT keywords) in GET parameters provides additional defense-in-depth, though it carries a risk of false positives on legitimate numeric id values. The VulDB advisory is available at https://vuldb.com/vuln/360119.