CVE-2026-10559

2.1 lowEPSS 0.2%

Low (2.1). EPSS 0.2% chance of exploitation in the next 30 days.

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-73
Published: 2026-06-02
Modified: 2026-07-22
Record from: the NVD, synced 2026-10-19

References

https://github.com/cyber-bhaskar10/CVE-Writeups/blob/main/CVE%20Writeup%20LFI%20via%20Null%20Byte%20Injection%20in%20index.php.md
https://vuldb.com/cve/CVE-2026-10559
https://vuldb.com/submit/828822
https://vuldb.com/vuln/367649
https://vuldb.com/vuln/367649/cti

Check your stack JSON