CVE-2026-108827 in Zen Cart
Prediction
by VulDB Data Team • 10/11/2026
A vulnerability was determined in <a href="/product/zen_cart">Zen Cart up to 2.2.2</a>. Affected is the function <code>zen_call_function</code> of the file <em>admin/includes/functions/general.php</em> of the component <em>Administrative Module Management</em>. Executing a manipulation of the argument <em>use_function</em> can lead to code injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.