Medium severity4.7NVD Advisory· Published Jul 19, 2026· Updated Jul 20, 2026

CVE-2026-16226

Description

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.

Affected products

Sourcecodester/Pizzafy Ecommerce Systemllm-fuzzy2 versions
1.0+ 1 more
- (no CPE)range: 1.0
- (no CPE)range: =1.0

Patches

Vulnerability mechanics

References

vuldb.com/cve/CVE-2026-16226nvd
vuldb.com/submit/858229nvd
vuldb.com/vuln/380048nvd
vuldb.com/vuln/380048/ctinvd
www.sourcecodester.comnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000