CVE-2026-7296: SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function saveorder of the file /admin/ajax.php?action=saveorder. Performing a manipulation of the argument firstname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7296?
CVE-2026-7296 has a medium severity due to its potential for cross-site scripting attacks that could be exploited to execute malicious scripts.
How do I fix CVE-2026-7296?
To fix CVE-2026-7296, validate and sanitize user input in the save_order function to prevent harmful scripts from being executed.
Which version of SourceCodester Pizzafy Ecommerce System is affected by CVE-2026-7296?
CVE-2026-7296 affects version 1.0 of the SourceCodester Pizzafy Ecommerce System.
What is the nature of the vulnerability in CVE-2026-7296?
The vulnerability in CVE-2026-7296 is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts.
Where is the vulnerable code located in CVE-2026-7296?
The vulnerable code is located in the /admin/ajax.php file within the save_order function, specifically when handling the first_name argument.