CVE-2026-103904
Critical
Description
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
SeverityCritical
CVSS9.3
Exploit probability35. percentile0.4%
ProductJTL-Shop
PublishedOct 14, 2026
First seenOct 14, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- JTL-Software GmbH JTL-Shop5.6.5, 5.7.5, 5.8.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| JTL-Software GmbH JTL-Shop | 5.4.0 ≤ v < 5.6.5, 5.7.0 ≤ v < 5.7.5, 5.8.0 ≤ v < 5.8.2 | 5.6.5, 5.7.5, 5.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.