Is there a public PoC exploit available for EUVD-2026-26034?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26034. Prioritise patching immediately. EPSS: 0.0%.

Pizzafy Ecommerce System EUVD-2026-26034

Q: What is the CVSS score of EUVD-2026-26034?

EUVD-2026-26034 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7268 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 28, 2026 - 12:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 12:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 11:45 euvd

EUVD-2026-26034

Analysis Generated

Apr 28, 2026 - 11:45 vuln.today

CVE Published

Apr 28, 2026 - 11:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Name parameter in the save_category function at /admin/ajax.php. The vulnerability requires valid administrative credentials but poses moderate confidentiality, integrity, and availability risk. Publicly available exploit code exists and EPSS score of 0.84 indicates high exploitation probability despite the authentication gate.

Technical ContextAI

Pizzafy Ecommerce System is a PHP-based e-commerce application vulnerable to CWE-89 SQL injection in its administrative AJAX interface. The save_category endpoint fails to sanitize or parameterize the Name parameter before incorporating it into SQL queries, allowing attackers with administrative access to craft malicious payloads that manipulate database operations. The vulnerability affects all versions of the product based on the CPE string (cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:*), though version 1.0 is explicitly documented as vulnerable.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigations include: restrict administrative access to trusted users only and audit all admin accounts for unauthorized access; implement database query parameterization and input validation in the save_category function at /admin/ajax.php using prepared statements for all SQL operations; monitor /admin/ajax.php for suspicious requests containing SQL metacharacters in the Name parameter; and implement Web Application Firewall rules to block requests containing common SQL injection patterns targeting the save_category endpoint. Organizations should contact SourceCodester (https://www.sourcecodester.com/) to request a security patch. Until patching is available, disable the category management functionality if not actively used, or restrict access to the /admin/ directory via network controls (IP whitelisting).