CVE-2026-108827

Published: Ott 12, 2026 Last Modified: Ott 12, 2026

ExploitDB:

Other exploit source:

Google Dorks:

LOW 1,2

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

MEDIUM 4,1

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: none

Scope: unchanged

Confidentiality: low

Integrity: low

Availability: low

MEDIUM 4,3

Source: [email protected]

Access Vector: network

Access Complexity: high

Authentication: multiple

Confidentiality: partial

Integrity: partial

Availability: partial

Description

AI Translation Available

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: 'We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere'.