CVE-2026-7268

MediumCVSS 6.3/10Last modified Oct 26, 2026

Description

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Pizzafy Ecommerce System	1.0

References

Timeline

Published: Apr 28, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-726805.4Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership CVE-2026-726818.8Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it CVE-2026-726826.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-726836.5A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.CVE-2026-726846.5A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user CVE-2026-726854.3A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a cr CVE-2026-726866.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A sp CVE-2026-726876.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. E CVE-2026-726887.5A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbit CVE-2026-726897.5A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to CVE-2026-72692.4A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?CVE-2026-726907.1An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent man