Is there a public PoC exploit available for CVE-2026-7408?

Yes, a public proof-of-concept exploit is available for CVE-2026-7408. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce CVE-2026-7408

Q: What is the CVSS score of CVE-2026-7408?

CVE-2026-7408 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26290 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 21:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Analysis Generated

Apr 29, 2026 - 21:00 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 20:57 euvd

EUVD-2026-26290

Analysis Generated

Apr 29, 2026 - 20:57 vuln.today

CVE Published

Apr 29, 2026 - 20:45 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.

Technical ContextAI

The vulnerability exists in the save_menu function of /admin/ajax.php, a PHP-based administrative AJAX endpoint. The root cause is CWE-89 (SQL Injection), indicating improper neutralization of special SQL command syntax in user-controlled input passed to database queries. The CPE designation cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system covers the Pizzafy Ecommerce System product line. The attack vector is network-based (AV:N), suggesting the vulnerable endpoint is accessible over HTTP/HTTPS without special network positioning. The SQL injection allows an attacker with administrative access to craft malicious input that manipulates SQL queries, potentially exfiltrating or modifying database contents.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate compensating controls include: (1) Restrict access to /admin/ajax.php at the web application firewall or reverse proxy level to trusted internal IP ranges only, reducing exposure despite the network-accessible nature of the endpoint; (2) Implement input validation and parameterized queries (prepared statements) in the save_menu function to neutralize SQL injection, noting this requires code modification; (3) Apply strict privilege separation - ensure only genuinely necessary administrators have access to the menu save function, using role-based access controls to limit PR:H exposure; (4) Monitor admin account activity via logging to detect anomalous SQL patterns or unauthorized menu modifications. Organizations should contact SourceCodester directly (https://www.sourcecodester.com/) to request a patched version. If the product is no longer actively maintained, consider replacement with a supported alternative.