CVE-2026-108826

HIGH 7.3

Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.

CWE	CWE-89 CWE-74
Vendor	n/a
Product	zen cart
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for n/a zen cart

Be the first to know when new high vulnerabilities affecting n/a zen cart are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / Zen Cart

2.2.0 2.2.1 2.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416602 vuldb.com: https://vuldb.com/vuln/416602/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108826 vuldb.com: https://vuldb.com/submit/883833 cdkkx.github.io: https://cdkkx.github.io/posts/VE-0086.html github.com: https://github.com/zencart/zencart/commit/557154f4fa025f51553094f47b06aa024220c48f

Credits

🔍 cdhhsk (VulDB User)