CVE-2026-16226

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_settings of the file /admin/admin_class_novo.php. This manipulation of the argument img causes unrestricted upload. The attack is possible to be carried out remotely.

• CWE-284
• CWE-434

• https://vuldb.com/cve/CVE-2026-16226
• https://vuldb.com/submit/858229
• https://vuldb.com/vuln/380048
• https://vuldb.com/vuln/380048/cti
• https://www.sourcecodester.com/
• https://vuldb.com/submit/858229

Published

Jul 19, 2026

Last Modified

Jul 20, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16220A vulnerability has been found in code-projects Online Exami…4.3
• CVE-2026-16221Impact: fast-uri versions from 2.3.1 through 4.1.0 (includin…7.5
• CVE-2026-16222A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.…6.3
• CVE-2026-16223A vulnerability was determined in 1Panel-dev CordysCRM up to…6.3
• CVE-2026-16224A vulnerability was identified in jxxghp MoviePilot up to 2.…5.3
• CVE-2026-16225A security flaw has been discovered in davenardella snap7 up…6.3
• CVE-2026-16227A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-16228A vulnerability was detected in SourceCodester Class and Exa…7.3
• CVE-2026-16229A flaw has been found in itsourcecode Courier Management Sys…4.3
• CVE-2026-1623A weakness has been identified in Totolink A7000R 4.1cu.4154…6.3
• CVE-2026-16230The Formidable Digital Signatures plugin for WordPress is vu…9.8
• CVE-2026-16231hbs is an Express view engine that wraps Handlebars. Its reg…8.1