Skip to content
OpenAdvisories

Vendor

JTL-Software

3 known vulnerabilities.

Products

JTL-Shop 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-103904

    Stored XSS Vulnerability in JTL-Shop

    The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the ad…

    JTL-Software JTL-Shop
  • Critical 9.8
    CVE-2026-54390 Public exploit

    JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

    JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can …

    JTL-Software JTL-Shop