CVE-2026-108829
MediumCVSS 4.7Summary
A SQL injection vulnerability was discovered in Zen Cart up to 2.2.2, affecting admin/modules.php of the Module Configuration component, via manipulation of the configuration argument. The attack can be launched remotely, and the exploit is publicly available. Patch identified as 08f572654edee1db8f9db091c9949825c6c69339.
Risk Assessment
The vulnerability allows an attacker to execute unauthorized queries against the database, potentially leading to data leakage, modification, or deletion.
Recommendation
It is recommended to apply the patch or update Zen Cart to a version that includes the fix.
Other vulnerabilities in Zen Cart
See all- CVE-2026-108828Medium
A SQL injection vulnerability was identified in Zen Cart 2.2.2, affecting the eval function of admin/configuration.php in the Admin Panel component, via manipulation of the gID argument. The attack can be initiated remotely, has high complexity, and is difficult to exploit. The exploit is publicly available. The vendor explains that set_function/use_function are not editable through any normal admin UI.
- CVE-2026-108827Medium
A code injection vulnerability was identified in Zen Cart up to 2.2.2, affecting the zen_call_function function of admin/includes/functions/general.php in the Administrative Module Management component, via manipulation of the use_function argument. The attack can be launched remotely, has high complexity, and is difficult to exploit. The exploit has been publicly disclosed. The vendor states they do not consider this an independently exploitable vulnerability.
- CVE-2026-108826High
A vulnerability was found in Zen Cart up to version 2.2.2, affecting the zen_db_perform function in includes/modules/payment/paypaldp.php of the PayPal IPN Handler component. Manipulation of the txn_id argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been made public.
- CVE-2015-8352Critical
Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.
Original NVD description (English source)
A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS