CVE-2026-7226
Published: 28 April 2026
Summary
CVE-2026-7226 is a high-severity Injection (CWE-74) vulnerability in Sourcecodester (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation and sanitization of inputs like the e-mail argument, directly preventing SQL injection exploitation in the login2 function.
SI-2 mandates timely identification, reporting, and correction of flaws such as the SQL injection vulnerability in /admin/ajax.php?action=login2.
SC-7 provides boundary protection via web application firewalls or similar to block remote SQL injection attempts on the unauthenticated admin endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app login endpoint directly enables remote exploitation for initial access without auth.
NVD Description
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of the attack is possible. The…
more
exploit has been disclosed publicly and may be used.
Deeper analysisAI
CVE-2026-7226 is a SQL injection vulnerability (CWE-74, CWE-89) in SourceCodester Pizzafy Ecommerce System 1.0. The issue resides in the login2 function of the file /admin/ajax.php?action=login2, where manipulation of the e-mail argument triggers the injection. Published on 2026-04-28, it carries a CVSS v3.1 base score of 7.3 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction due to low attack complexity. Successful exploitation enables SQL injection, allowing limited impacts on confidentiality, integrity, and availability as reflected in the CVSS metrics.
Advisories and further details are available via VulDB entries (https://vuldb.com/vuln/359826, https://vuldb.com/vuln/359826/cti, https://vuldb.com/submit/802413) and a GitHub vulnerability submission (https://github.com/fernando-mengali/vulndb-submissions/blob/main/03-vul-SQLI.md). The vendor site is at https://www.sourcecodester.com/.
The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)