CVE-2026-108826

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108826

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108826.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108826

Published

2026-10-12T10:45:10Z

Modified

2026-10-14T10:31:06Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection

Details

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn_id results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named 557154f4fa025f51553094f47b06aa024220c48f. It is suggested to install a patch to address this issue.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-74",
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108826.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "last_affected":  "2.2.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/zencart/zencart

Affected ranges

Type

GIT

Repo

https://github.com/zencart/zencart

Events

Introduced

8a1f54717814e205fca81a35ae83f445b298bf61

Fixed

557154f4fa025f51553094f47b06aa024220c48f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "2.2.1"
        },
        {
            "last_affected":  "2.2.1"
        },
        {
            "introduced":  "2.2.2"
        },
        {
            "last_affected":  "2.2.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.2.1

2.2.2

v2.*

v2.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108826.json"