CVE-2026-108826
HighCVSS 7.3Summary
A vulnerability was found in Zen Cart up to version 2.2.2, affecting the zen_db_perform function in includes/modules/payment/paypaldp.php of the PayPal IPN Handler component. Manipulation of the txn_id argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been made public.
Risk Assessment
A remote attacker can inject SQL commands, potentially leading to unauthorized data access or modification. The publicly available exploit increases the likelihood of exploitation.
Recommendation
Install the available patch identified as 557154f4fa025f51553094f47b06aa024220c48f to address the issue. Until the patch is applied, consider limiting exposure of the PayPal IPN component.
Other vulnerabilities in Zen Cart
See all- CVE-2026-108829Medium
A SQL injection vulnerability was discovered in Zen Cart up to 2.2.2, affecting admin/modules.php of the Module Configuration component, via manipulation of the configuration argument. The attack can be launched remotely, and the exploit is publicly available. Patch identified as 08f572654edee1db8f9db091c9949825c6c69339.
- CVE-2026-108828Medium
A SQL injection vulnerability was identified in Zen Cart 2.2.2, affecting the eval function of admin/configuration.php in the Admin Panel component, via manipulation of the gID argument. The attack can be initiated remotely, has high complexity, and is difficult to exploit. The exploit is publicly available. The vendor explains that set_function/use_function are not editable through any normal admin UI.
- CVE-2026-108827Medium
A code injection vulnerability was identified in Zen Cart up to 2.2.2, affecting the zen_call_function function of admin/includes/functions/general.php in the Administrative Module Management component, via manipulation of the use_function argument. The attack can be launched remotely, has high complexity, and is difficult to exploit. The exploit has been publicly disclosed. The vendor states they do not consider this an independently exploitable vulnerability.
- CVE-2015-8352Critical
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Original NVD description (English source)
A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS