EIP-2026-114625

This document details two SQL injection vulnerabilities in ZeusCart 4.0, including a blind timing-based SQLi in the maincatid parameter and an authenticated SQLi in the admin area via file upload manipulation. It provides proof-of-concept URLs, curl commands, and code snippets demonstrating the exploits.