CVE-2026-7293

MediumCVSS 4.7/10Last modified Oct 26, 2026

Description

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete_category. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Pizzafy Ecommerce System	1.0

References

Timeline

Published: Apr 28, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-729307.0Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.CVE-2026-729315.5Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to den CVE-2026-729327.5Buffer over-read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.CVE-2026-729338.8Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network.CVE-2026-729347.0Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.CVE-2026-729356.7Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-729368.1Use after free in Windows SMB Client allows an unauthorized attacker to execute code over a network.CVE-2026-729375.5Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally.CVE-2026-729386.5Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose inf CVE-2026-729396.5Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service over a network.CVE-2026-72942.4A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the fi CVE-2026-729408.8Heap-based buffer overflow in Windows Schannel allows an unauthorized attacker to execute code over a network.