Vendor
JTL Shop
Products
1
CVEs
2
Across products
2
Status
Private
Products
1- 2 CVEs
Recent CVEs
2| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-103904 | Cri | 0.60 | 9.3 | — | Oct 14, 2026 | The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration… | ||
| CVE-2026-103905 | Hig | 0.49 | 7.5 | — | Oct 14, 2026 | The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode… |
- risk 0.60cvss 9.3epss —
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration…
- risk 0.49cvss 7.5epss —
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode…