A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_cart_items. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-7230 is a medium severity cross-site scripting (XSS) vulnerability in SourceCodester Safety Anger Pad version 1.0. The vulnerability arises from improper handling of the 'angerDisplay' argument in an unknown function, allowing remote attackers to inject malicious scripts. The exploit has been publicly disclosed but there are no known exploits in the wild. No official patch or remediation guidance is currently available.
CVE-2026-7228 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The flaw exists in the get_cart_count function within /admin/ajax.php when handling the ID argument. This vulnerability allows remote attackers to manipulate SQL queries via the ID parameter. Although an exploit has been published, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided yet.
CVE-2026-7227 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. It affects the login function in the /admin/ajax.php? action=login endpoint by allowing remote attackers to manipulate the 'e-mail' parameter to perform SQL injection. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet.
CVE-2026-7226 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The issue exists in the login2 function within /admin/ajax.php when processing the e-mail argument. This flaw allows remote attackers to manipulate SQL queries via the e-mail parameter. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-7225 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. It affects the delete_menu function in the /admin/ajax.php endpoint when the ID parameter is manipulated. This vulnerability can be exploited remotely without authentication and allows attackers to execute unauthorized SQL commands. Although a public exploit exists, there is no confirmed patch or official remediation available at this time.
CVE-2026-7224 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. It affects the delete_cart function in the /admin/ajax.php endpoint when the ID argument is manipulated. The vulnerability allows remote attackers to perform SQL injection attacks. Although an exploit has been publicly released, there is no confirmed patch or official remediation available at this time.
CVE-2026-7200 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The issue exists in the /index.php? page=types file where manipulation of the ID argument allows remote attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-7199 is a SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The issue exists in the /ajax.php? action=delete_product endpoint where manipulation of the ID parameter allows remote attackers to perform SQL injection. The vulnerability has a medium severity with a CVSS score of 6.9. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-7194 is a medium severity SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in the /ajax.php? action=save_product endpoint where manipulation of the ID parameter allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_category. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=save_type. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_receiving. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_category. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-7088 is a medium-severity SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in an unspecified function within the /ajax.php? action=save_receiving endpoint, where manipulation of the ID parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_sales. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=login. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-6188 is a medium-severity SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in the /ajax.php? action=delete_sales endpoint where manipulation of the ID parameter allows remote attackers to perform SQL injection. This vulnerability can be exploited without authentication or user interaction. No official patch or remediation guidance has been provided by the vendor at this time. The exploit code is publicly available, increasing the risk of exploitation.
CVE-2026-6187 is a medium severity SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. It arises from improper handling of the 'ID' parameter in the /ajax.php? action=chk_prod_availability endpoint, allowing remote attackers to inject SQL commands. The vulnerability is publicly known, but no official patch or remediation guidance has been provided by the vendor as of the publication date.