Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

JTL-Shop admin page can run malicious scripts

CVE-2026-103904 · published 6 days ago
Summary

JTL-Shop stores consent names entered by anyone without checking them, and then shows those names on an admin page without protecting the content. A malicious user could place script code in a consent name, which would run in an administrator's browser when they view the consent statistics, potentially letting the attacker act as the admin. Update the software to the latest version or apply the vendor's patch, and limit who can submit consent data.

What to do
  • Update jtl-software gmbh jtl-shop to version 5.6.5 or later.
Affected software
VendorProductAffected versions
jtl-software gmbh jtl-shop < 5.6.5
Original advisory text
Stored XSS Vulnerability in JTL-Shop
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Oct 2026
Updated19 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-103904 · NVD
CVE-2026-103904 · MITRE
Track software like this
Free during beta