TI-2026-71596 CVE-2026-89309 · GHSA-7chg-cp4g-f4v9
Missing authentication in JTL-WMS lets remote attackers use the API
Priority MEDIUM 49
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases.
JTL SW GmbH
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
JTL SW GmbH records in CISA KEVNo JTL SW GmbH vulnerabilities are listed in CISA KEV.
Records
2 records
TI-2026-73773 CVE-2026-89310 · GHSA-rgrc-89rr-p923
SQL injection in JTL-WMS lets remote attackers run SQL statements
Priority MEDIUM 43
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database…