Description
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.
Published: 2026-07-19
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an unrestricted file upload in the save_settings function of admin_class_novo.php, allowing an attacker to supply any file via the img argument. Depending on the file type and server configuration, this could lead to remote code execution or the placement of malicious files on the server.

Affected Systems

SourceCodester Pizzafy Ecommerce System 1.0, specifically the admin_class_novo.php module.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk level. An EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, through the web interface, with no need for local privileges.

Generated by OpenCVE AI on July 30, 2026 at 22:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor‑released patch or update for SourceCodester Pizzafy Ecommerce System.
  • Restrict the upload feature to accept only explicitly whitelisted file types and validate MIME types on the server side.
  • Place uploaded content outside the web root or enforce strict directory permissions to prevent direct execution of uploaded files.

Generated by OpenCVE AI on July 30, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 19 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.
Title SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload
First Time appeared Sourcecodester
Sourcecodester pizzafy Ecommerce System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester pizzafy Ecommerce System
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Sourcecodester Pizzafy Ecommerce System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-20T13:20:54.419Z

Reserved: 2026-07-18T12:31:42.400Z

Link: CVE-2026-16226

cve-icon Vulnrichment

Updated: 2026-07-20T13:20:40.779Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T22:45:04Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type