Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: JTL-Software GmbH Clear all filters
TI-2026-73907 CVE-2026-103905 · GHSA-xvw9-2xw4-g33x

Unauthenticated plugin safe mode toggle in JTL-Shop enables denial of service

Priority MEDIUM 44

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00531 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-306
TI-2026-73906 CVE-2026-103904 · GHSA-xqfj-gwfj-j97g

Stored cross-site scripting in JTL-Shop consent statistics

Priority LOW 39

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00404 Published 2026-10-14 Fixed in 5.6.5, 5.7.5 +1 CWE-79
TI-2026-39268 CVE-2026-54390 · GHSA-pxq6-fr5m-fwh5

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

Priority MEDIUM 49

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00604 Published 2026-06-18 Fixed in 5.0.0, 5.5.4 +2 CWE-1336