The vulnerability is an unrestricted file upload flaw in the save_menu function of admin_class_novo.php within the SourceCodester Pizzafy Ecommerce System. By manipulating the img argument, an attacker can upload arbitrary files without restriction, which can include executable scripts such as PHP, leading to potential remote code execution. This weakness is identified as CWE‑434 (Unrestricted Upload of File with Dangerous Type) and CWE‑284 (Improper Access Control). An attacker who successfully uploads code could have full control over the web application, read or modify sensitive data, and compromise the underlying server.

SourceCodester Pizzafy Ecommerce System version 1.0 is affected. The flaw resides in the admin_class_novo.php file, part of the File Extension Handler component of the system.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score is not available, so the probability of exploitation cannot be precisely quantified. The vulnerability is not listed in CISA KEV. Based on the description, the attack vector is inferred to be remote; the exploit has been made public, implying that an attacker who can reach the admin interface or the file upload endpoint can trigger the flaw. Successful exploitation requires only the ability to send a crafted request, making the risk moderate but potentially high if no other mitigations are in place.