CVE-2026-16226CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2026-16226

Medium · published July 19, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-19T13:17Z
References (6)
https://vuldb.com/cve/CVE-2026-16226 · [email protected]https://vuldb.com/submit/858229 · [email protected]https://vuldb.com/vuln/380048 · [email protected]https://vuldb.com/vuln/380048/cti · [email protected]https://www.sourcecodester.com/ · [email protected]https://vuldb.com/submit/858229 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 JUL 08:15Z
    SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload
    cvelistv5