CVE-2026-7297

LowCVSS 2.4/10Last modified Jul 24, 2026

Description

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function save_user of the file /admin/ajax.php?action=save_user. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

VendorProductVersions
SourceCodesterPizzafy Ecommerce System1.0

References

Timeline

Published
Apr 28, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-729708.3Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-729715.5Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authoCVE-2026-729728.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-729738.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-729746.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-729756.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-729765.0Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.CVE-2026-729776.5Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.CVE-2026-729787.5Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to denyCVE-2026-729799.8Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.CVE-2026-72986.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade ICVE-2026-729805.5Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
CVE-2026-7297: Low severity, CVSS 2.4 | Vulnix