CVE-2026-7226

SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection

CVSS 6.9 MEDIUMEPSS 0.3%CWE-74 CWE-89

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

SourceCodester · Pizzafy Ecommerce System

public PoCs found — 1

cve_referencegithub.com/fernando-mengali/vulndb-submissions/blob/main/03-vul-SQLI.mdunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/fernando-mengali/vulndb-submissions/blob/main/03-vul-SQLI.md https://vuldb.com/submit/802413 https://vuldb.com/vuln/359826 https://vuldb.com/vuln/359826/cti https://www.sourcecodester.com/