CVE-2026-16226 in Pizzafy Ecommerce System

Prediction

by VulDB Data Team • 07/18/2026

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-380048
• CPE: ready
• CWE: CWE-434 (confirmed)
• CVSS: 4.7 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Transportation, Telecommunication, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-16226
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16226
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-16226/