CVE-2026-108826: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...