Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: JTL-Software JTL-Shop 5.6.5, 5.7.5, 5.8.2 Clear all filters
TI-2026-73907 CVE-2026-103905 · GHSA-xvw9-2xw4-g33x

Unauthenticated plugin safe mode toggle in JTL-Shop enables denial of service

Priority MEDIUM 44

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00531 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-306
TI-2026-73906 CVE-2026-103904 · GHSA-xqfj-gwfj-j97g

Stored cross-site scripting in JTL-Shop consent statistics

Priority LOW 39

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00404 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-79