CVE-2026-10704

🗓️ 03 Jun 2026 00:45:08Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

SQL injection in SourceCodester Pizzafy admin login via Username allows remote exploitation.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-10704	3 Jun 202600:45	–	attackerkb
Circl	CVE-2026-10704	3 Jun 202603:39	–	circl
CNNVD	SourceCodester Pizzafy E-Commerce System SQL注入漏洞	3 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-10704 SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection	3 Jun 202600:45	–	cvelist
EUVD	EUVD-2026-34063	3 Jun 202600:45	–	euvd
NVD	CVE-2026-10704	3 Jun 202602:16	–	nvd
Positive Technologies	PT-2026-45898	3 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-10704	5 Jun 202619:34	–	redhatcve
Vulnrichment	CVE-2026-10704 SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection	3 Jun 202600:45	–	vulnrichment

Vulners

Node

sourcecodester pizzafy_e-commerce_systemMatch1.0

[
  {
    "vendor": "SourceCodester",
    "product": "Pizzafy E-Commerce System",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:sourcecodester:pizzafy_e-commerce_system:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Administrative Control Panel"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/368017
vuldb	www.vuldb.com/cve/CVE-2026-10704
sourcecodester	www.sourcecodester.com/
vuldb	www.vuldb.com/vuln/368017/cti
github	www.github.com/nuiifornet/A033/blob/main/pizzafy-vulnerability.md
vuldb	www.vuldb.com/submit/831321

Parameter	Position	Path	Description	CWE
Username	request body	/admin/admin_class_novo.php	SQL injection in login function via Username parameter in /admin/admin_class_novo.php (remote exploit, public PoC).	CWE-89, CWE-74

17 Jun 2026 10:12Current

6.9Medium risk

Vulners AI Score6.9

CVSS 46.9

CVSS 3.17.3

CVSS 27.5

CVSS 37.3

EPSS0.00281

SSVC