Is there a public PoC exploit available for EUVD-2026-26137?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26137. Prioritise patching immediately. EPSS: 0.0%.

SourceCodester Pizzafy Ecommerce EUVD-2026-26137

Q: What is the CVSS score of EUVD-2026-26137?

EUVD-2026-26137 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7293 LOW

SQL Injection (CWE-89)

2026-04-28 VulDB

PHP SQLi

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 28, 2026 - 20:06 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

4.7 (MEDIUM) 5.1 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26137

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

CVE Published

Apr 28, 2026 - 17:45 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete_category. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in the delete_category function (/admin/ajax.php?action=delete_category). The vulnerability requires high-privilege authentication but enables limited confidentiality and integrity impact. Publicly available exploit code exists, elevating real-world risk despite the moderate CVSS score of 5.1.

Technical ContextAI

The vulnerability exists in a PHP-based ecommerce application where the /admin/ajax.php endpoint handles AJAX requests with an action parameter. The delete_category function fails to properly sanitize or parameterize the ID argument before incorporating it into SQL queries, allowing an attacker to inject arbitrary SQL syntax. This is a classic CWE-89 SQL injection flaw in a web application context. The attack vector is network-based via HTTP request manipulation, and the vulnerability resides in the administrative interface layer of the application.

RemediationAI

Upgrade to a patched version if released by SourceCodester; check https://www.sourcecodester.com/ for security updates. If an upgrade is unavailable, implement the following compensating controls: (1) restrict access to /admin/ajax.php to a whitelist of trusted IP ranges, reducing exposure to internal networks only - this eliminates remote attack surface but requires network segmentation; (2) enforce Web Application Firewall (WAF) rules to block SQL injection payloads in the ID parameter (patterns like UNION, SELECT, OR 1=1); (3) apply parameterized queries or prepared statements in the delete_category function if source code access is available; (4) implement input validation to accept only numeric IDs, rejecting any non-digit characters before SQL processing. Priority: immediate patch or restrict admin interface access pending a vendor security release.