JTL-Shop vulnerabilities
CVEs whose affected-version data names the JTL-Shop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-103905High· 7.5The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can the…
▾ TwilightJTL-Software GmbH · JTL-ShopEPSS 0.53%via NVD
CVE-2026-103904Critical· 9.3The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without out…
▾ MidnightJTL-Software GmbH · JTL-ShopEPSS 0.40%via NVD