CVE-2026-7393 - Vulnerability Analysis

Overview

SourceCodester Pizzafy Ecommerce System 1.0 contains an unrestricted file upload vulnerability caused by improper validation of the "img" argument in save_menu function of /admin/admin_class_novo.php, letting remote attackers upload arbitrary files, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can upload arbitrary files, potentially leading to remote code execution or full system compromise.

Mitigation

Update to the latest version or apply patches that restrict file upload validation.

References

• https://vuldb.com/submit/803522
• https://vuldb.com/vuln/360118
• https://vuldb.com/vuln/360118/cti
• https://www.sourcecodester.com/
• https://github.com/Xmyronn/Unrestricted-File-Upload-leading-to-Remote-Code-Execution-in-Pizzafy-Ecommerce-System.git

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner