Threat Intelligence Database

CVE-2026-108828 is a SQL injection vulnerability in Zen Cart version 2.2.2 affecting the eval function in admin/configuration.php within the Admin Panel component. The vulnerability arises from manipulation of the gID argument. Exploitation requires high complexity and administrative privileges, and no user interaction is needed. The vendor notes that the related functions set_function and use_function are not editable through the normal admin UI, limiting attack vectors. The CVSS score is low (2.1), reflecting the difficulty and limited impact of exploitation.

CVE-2026-108827 is a low-severity code injection vulnerability in Zen Cart versions 2.2.0, 2.2.1, and 2.2.2. It affects the zen_call_function in the admin/includes/functions/general.php file, specifically the Administrative Module Management component. The vulnerability involves manipulation of the use_function argument, which could lead to code injection if exploited. However, exploitation is complex and requires prior control over the configuration table via SQL Patch tool or an existing SQL injection vulnerability. The vendor states this is not independently exploitable and no patch information is provided.