Is there a public PoC exploit available for CVE-2026-7409?

Yes, a public proof-of-concept exploit is available for CVE-2026-7409. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce System CVE-2026-7409

Q: What is the CVSS score of CVE-2026-7409?

CVE-2026-7409 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26291 LOW

SQL Injection (CWE-89)

2026-04-29 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:52 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 22:22 NVD

4.7 (MEDIUM) 2.0 (LOW)

Analysis Generated

Apr 29, 2026 - 22:00 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 21:30 euvd

EUVD-2026-26291

Analysis Generated

Apr 29, 2026 - 21:30 vuln.today

CVE Published

Apr 29, 2026 - 21:00 nvd

LOW 2.0

DescriptionCVE.org

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_user of the file /admin/ajax.php?action=save_user. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with high privileges to manipulate the save_user function in /admin/ajax.php via crafted input, enabling data exfiltration and modification. The vulnerability requires administrative credentials, has publicly available exploit code, and poses moderate risk (CVSS 4.7) primarily to systems where admin accounts are compromised or weak.

Technical ContextAI

The vulnerability exists in the AJAX endpoint /admin/ajax.php, specifically the save_user action handler, which fails to properly sanitize or parameterize user input before incorporating it into SQL queries. This is a classic SQL injection flaw (CWE-89: Improper Neutralization of Special Elements used in an SQL Command) commonly found in PHP-based legacy applications that concatenate user input directly into query strings rather than using prepared statements or parameterized queries. The affected product is identified by CPE cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system, indicating this is a PHP-based e-commerce application.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate remediation requires upgrading to a patched version if available from SourceCodester, or contacting the vendor at sourcecodester.com for security advisory. If patching is unavailable, implement compensating controls: (1) Apply strict input validation and parameterized SQL queries (prepared statements with bound parameters) to the save_user function in /admin/ajax.php - this eliminates the root cause but requires code modification and testing; (2) Restrict access to /admin/ajax.php via IP whitelisting or Web Application Firewall (WAF) rules blocking requests with SQL metacharacters in the action parameter - trade-off is reduced functionality for remote administration; (3) Enforce strong, unique administrative credentials and disable default admin accounts - reduces likelihood of credential compromise that enables exploitation; (4) Implement database-level privilege separation so the PHP application's database user account has minimal INSERT/UPDATE rights, preventing deletion or bulk data exfiltration - trade-off is application redesign effort.