Read the docs

JTL-Software GmbH

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

JTL-Software GmbH records in CISA KEV

No JTL-Software GmbH vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Jtl-shop 1 record LOW

Records

4 records

TI-2026-39268 CVE-2026-54390 · GHSA-pxq6-fr5m-fwh5

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

Priority MEDIUM 49

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00604 Published 2026-06-18 Fixed in 5.0.0, 5.5.4 +2 CWE-1336
TI-2026-73907 CVE-2026-103905 · GHSA-xvw9-2xw4-g33x

Unauthenticated plugin safe mode toggle in JTL-Shop enables denial of service

Priority MEDIUM 44

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00531 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-306
TI-2026-73906 CVE-2026-103904 · GHSA-xqfj-gwfj-j97g

Stored cross-site scripting in JTL-Shop consent statistics

Priority LOW 39

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00404 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-79
Open these records in search →