A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/view_order.php of the component GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file /admin/admin_class_novo.php of the component File Extension Handler. Performing a manipulation of the argument img results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?action=delete_supplier. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-7391 is a medium-severity SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in the save_supplier function within /ajax.php? action=save_supplier, where manipulation of the ID argument allows remote attackers to perform SQL injection. Exploit code has been published, but there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?page=customer. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-7297 is a cross-site scripting (XSS) vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. It affects the save_user function in the /admin/ajax.php endpoint when handling the Name parameter. This vulnerability allows remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. The CVSS score is 4.8, indicating a medium severity level.
CVE-2026-7296 is a cross-site scripting (XSS) vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The issue exists in the save_order function within /admin/ajax.php when processing the first_name parameter. An attacker can remotely exploit this vulnerability by manipulating the first_name argument to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch or remediation guidance is currently available from the vendor. Exploit code has been publicly disclosed, but no known widespread exploitation has been reported.
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?action=save_menu. Such manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-7294 is a cross-site scripting (XSS) vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The vulnerability exists in the save_settings function within the /admin/index.php? page=save_settings file. It is caused by improper handling of the 'Name' argument, allowing an attacker to inject malicious scripts. The vulnerability can be exploited remotely and requires some user interaction. An exploit has been published, but there are no known exploits in the wild at this time. The CVSS 4.0 base score is 4.
CVE-2026-7293 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The issue exists in the delete_category function accessed via /admin/ajax.php? action=delete_category, where manipulation of the ID parameter allows SQL injection. The vulnerability can be exploited remotely without user interaction. Although a public exploit exists, there is no confirmed patch or official remediation available at this time.
A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?action=save_expired. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action=delete_expired. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?page=supplier. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-7269 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The vulnerability exists in an unknown function within the /index.php? page=product file, where manipulation of the ID argument can lead to XSS. The vulnerability can be exploited remotely and the exploit code has been publicly disclosed. The CVSS score is 4.8, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. The system is not a cloud service, so remediation depends on vendor or user action.
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action=save_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.