CVE-2026-7225: medium-severity vulnerability in SourceCodester Pizzafy Ecommerce System
SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.3%
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?action=delete_menu. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
SourceCodester · Pizzafy Ecommerce Systempublic PoCs found — 1
cve_referencegithub.com/fernando-mengali/vulndb-submissions/blob/main/02-vul-SQLI.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SourceCodester Pizzafy Ecommerce System
In the same product, most dangerous first.
CVE-2026-16226MEDIUMSourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted uploadEPSS 0.4%CVE-2026-8117MEDIUMSourceCodester Pizzafy Ecommerce System index.php cross site scriptingEPSS 0.3%CVE-2026-7393MEDIUMSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted uploadEPSS 0.3%CVE-2026-7228MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injectionEPSS 0.3%CVE-2026-7227MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php login sql injectionEPSS 0.3%CVE-2026-7226MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php login2 sql injectionEPSS 0.3%