Pizzafy Ecommerce System CVE-2026-8117

Q: What is the CVSS score of CVE-2026-8117?

CVE-2026-8117 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28475 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 cna@vuldb.com

GHSA-6f56-6pvf-gp4j

XSS PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 00:45 vuln.today

CVE Published

May 08, 2026 - 00:16 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects some unknown processing of the file /admin/index.php. Such manipulation of the argument page leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in SourceCodester Pizzafy Ecommerce System 1.0 via the page parameter in /admin/index.php allows remote attackers to inject malicious scripts that execute in a victim's browser with user interaction. CVSS 2.1 (low) reflects the requirement for user click-through; however, the vulnerability is disclosed publicly with proof-of-concept code available.

Technical ContextAI

The vulnerability exists in PHP-based web application code handling the 'page' parameter within the administrative interface (/admin/index.php). The underlying root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, aka 'Cross-site Scripting'), indicating the application fails to properly sanitize or encode user-supplied input before rendering it in HTML responses. This allows an attacker to craft a malicious URL containing JavaScript payload in the page parameter, which is then reflected back to the victim's browser without validation or encoding, causing the injected script to execute in the context of the admin interface.

RemediationAI

Immediate mitigation requires upgrading to a patched version if available from SourceCodester; however, no specific patched version number is provided in the available data. Contact SourceCodester directly via https://www.sourcecodester.com/ or check the project repository for updates. As a temporary compensating control, implement input validation and output encoding on the page parameter in /admin/index.php: validate the page parameter against a whitelist of expected admin pages and HTML-encode all user input before rendering in responses. Additionally, restrict access to /admin/ to specific IP ranges or deploy a Web Application Firewall (WAF) with XSS detection rules to block requests containing script tags or event handlers in the page parameter. These controls have minimal performance impact but require ongoing rule maintenance.