CVE-2026-16226

Name of the Vulnerable Software and Affected Versions SourceCodester Pizzafy Ecommerce System version 1.0

Description An unrestricted file upload issue exists in the save settings() function within the /admin/admin class novo.php file. A remote attacker can exploit this by manipulating the img argument to upload arbitrary files to the server.

Recommendations Update SourceCodester Pizzafy Ecommerce System version 1.0 to a version that addresses this issue. As a temporary workaround, restrict access to the /admin/admin class novo.php file or avoid using the img argument in the save settings() function until a patch is applied.