CVE-2026-14713

SourceCodester Pizzafy E-Commerce System ajax.php confirm_order sql injection

CVSS 6.9 MEDIUMCWE-74 CWE-89

Vexday Risk Score

10Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.9EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

05 jul 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A security flaw has been discovered in SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Productos afectados

SourceCodester · Pizzafy E-Commerce System

Referencias

https://github.com/J4ng3ay/CVE/issues/1 https://vuldb.com/cve/CVE-2026-14713 https://vuldb.com/submit/846718 https://vuldb.com/vuln/376303 https://vuldb.com/vuln/376303/cti https://www.sourcecodester.com/