Vulnerability · Published Apr 28, 2026 · Assigned by VulDB
CVE-2026-7265SourceCodester Pizzafy Ecommerce System index.php category sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in Pizzafy Ecommerce System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SourceCodester | Pizzafy Ecommerce System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-359916 | SourceCodester Pizzafy Ecommerce System index.php category sql injection vdb-entry, technical-description
- VDB-359916 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #802438 | SourceCodester Pizzafy Ecommerce System 1.0 SQL Injection third-party-advisory
- https://github.com/fernando-mengali/vulndb-submissions/blob/main/07-vul-SQLI.md exploit
- https://www.sourcecodester.com/ product