Is there a public PoC exploit available for CVE-2026-7408?

Yes, a public proof-of-concept exploit is available for CVE-2026-7408. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce CVE-2026-7408

Q: What is the CVSS score of CVE-2026-7408?

CVE-2026-7408 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26290 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi

2.0

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 21:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Analysis Generated

Apr 29, 2026 - 21:00 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 20:57 euvd

EUVD-2026-26290

Analysis Generated

Apr 29, 2026 - 20:57 vuln.today

CVE Published

Apr 29, 2026 - 20:45 nvd

LOW 2.0

DescriptionNVD

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-7408 vulnerability details – vuln.today

Back