Is there a public PoC exploit available for EUVD-2026-26139?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26139. Prioritise patching immediately. EPSS: 0.0%.

Pizzafy Ecommerce System EUVD-2026-26139

Q: What is the CVSS score of EUVD-2026-26139?

EUVD-2026-26139 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7295 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 VulDB

XSS PHP Pizzafy Ecommerce System

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Admin credentials and victim user interaction required; scope changes because XSS executes in a different user's browser context with low C and I impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:12 vuln.today

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

4.8 (MEDIUM) 1.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 28, 2026 - 19:52 NVD

LOW MEDIUM

CVSS changed

Apr 28, 2026 - 19:52 NVD

2.4 (LOW) 4.8 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26139

CVE Published

Apr 28, 2026 - 18:15 nvd

LOW 1.9

DescriptionCVE.org

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stored/reflected cross-site scripting in SourceCodester Pizzafy Ecommerce System 1.0 allows an authenticated administrator to inject arbitrary JavaScript via the Name parameter at /admin/ajax.php?action=save_menu, which executes in the browser of any user who subsequently loads the manipulated menu. A public proof-of-concept is documented in a researcher-submitted PDF on GitHub, though no active exploitation has been confirmed and EPSS sits at 0.03% (9th percentile). The CVSS 4.0 score of 1.9 correctly reflects the high privilege bar and required user interaction, making this a low-priority, researcher-reported finding with minimal real-world risk in typical deployments.

Technical ContextAI

Pizzafy Ecommerce System is a PHP-based ecommerce web application distributed by SourceCodester, a provider of open-source student and hobbyist web projects. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that the save_menu function fails to sanitize or HTML-encode the Name parameter before storing or rendering it in the browser, enabling injection of arbitrary HTML and JavaScript. The vulnerable endpoint is /admin/ajax.php?action=save_menu, residing within the admin panel. The CPE cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:* covers version 1.0 as the confirmed affected release, with no upper version bound established.

RemediationAI

No vendor-released patch has been identified at time of analysis; SourceCodester has not published a remediation advisory. The primary fix is to apply proper output encoding to the Name parameter in the save_menu function - in PHP, this means wrapping all user-supplied output with htmlspecialchars() using ENT_QUOTES before rendering to HTML. As an interim compensating control, restrict access to the /admin/ directory to trusted IP addresses via web server configuration (e.g., Apache Allow/Deny or nginx allow/deny directives), which eliminates the PR:H exploitation path for external attackers. Deploying a Content Security Policy (CSP) header that disallows inline scripts (script-src 'self') reduces the impact of any remaining XSS surface but may require testing for compatibility with the admin panel. A WAF rule blocking common XSS patterns (<script>, onerror=, javascript:) in the Name field provides additional shallow defense with low side-effect risk. The POC report at https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Menu.pdf details the specific payload and injection point for vendor reference.