CVE-2026-10559— SourceCodester Pizzafy Ecommerce System index.php file inclusion
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SourceCodester | Pizzafy Ecommerce System | 1.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10559
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SourceCodester Pizzafy Ecommerce System index.php file inclusion
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
SourceCodester Pizzafy Ecommerce System 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SourceCodester Pizzafy Ecommerce System是SourceCodester开源的一个电子商务系统。 SourceCodester Pizzafy Ecommerce System 1.0版本存在安全漏洞，该漏洞源于对文件/index.php中参数page的操作，可能导致文件包含。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SourceCodester | Pizzafy Ecommerce System | 1.0 | cpe:2.3:a:sourcecodester:pizzafy_ecommerce_system:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-10559
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10559
请登录查看更多情报信息。
Other References for CVE-2026-10559 (2)
Same Patch Batch · SourceCodester · 2026-06-02 · 3 CVEs total
| CVE-2026-10558 | 6.3 MEDIUM | SourceCodester Pizzafy Ecommerce System index.php file inclusion |
| CVE-2026-10624 | 4.3 MEDIUM | SourceCodester Human Resource Management Employee View detailview.php resource injection |
IV. Related Vulnerabilities
Same product: Pizzafy Ecommerce System
- CVE-2026-16226
SourceCodester Pizzafy Ecommerce System admin_class_novo.php - CVE-2026-10558
SourceCodester Pizzafy Ecommerce System index.php file inclu - CVE-2026-8117
SourceCodester Pizzafy Ecommerce System index.php cross site - CVE-2026-7410
SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart - CVE-2026-7409
SourceCodester Pizzafy Ecommerce System ajax.php save_user s
Same vendor: SourceCodester
- CVE-2026-16486
SourceCodester Class and Exam Timetabling System BSIS.php cr - CVE-2026-16485
SourceCodester Class and Exam Timetabling System class.php c - CVE-2026-16484
SourceCodester Class and Exam Timetabling System edit_subjec - CVE-2026-16228
SourceCodester Class and Exam Timetabling System edit_school - CVE-2026-16227
SourceCodester Class and Exam Timetabling System edit_subjec
Same weakness: CWE-73
- CVE-2026-64816
RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutP - CVE-2026-56390
Arbitrary Output Location Change in GNU Bison - CVE-2026-57916
Arbitrary Path Execution via CPS URI in proCertum SmartSign - CVE-2026-65896
Grav API Plugin before 1.0.10 Path Traversal via move - CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical appl
V. Comments for CVE-2026-10559
No comments yet