CVE-2026-7267

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-726706.5A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. TCVE-2026-726714.3A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target,CVE-2026-726727.7The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend evCVE-2026-726735.4Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality NoCVE-2026-726746.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130CVE-2026-726757.1Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege AbCVE-2026-726769.1Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script conCVE-2026-726777.3Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139)CVE-2026-726786.5Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal daCVE-2026-726796.5Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling CVE-2026-72686.3A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajCVE-2026-726805.4Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership
CVE-2026-7267: Medium severity, CVSS 6.3 | Vulnix