Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

JTL‑WMS could let attackers run database commands

CVE-2026-89310 · published 4 days ago
Summary

The JTL‑WMS system accepts data from users and inserts it directly into a database query without checking it first. This could let a remote attacker add their own commands and view, change, or delete information stored in the database. Apply the vendor’s update or patch and limit database privileges until the fix is in place.

What to do
  • Update jtl sw gmbh jtl-wms to version 2.0.7 or later.
Affected software
VendorProductAffected versions
jtl sw gmbh jtl-wms < 2.0.7
Original advisory text
SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into
a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-89310 · NVD
CVE-2026-89310 · MITRE
Track software like this
Free during beta