JTL-WMS vulnerabilities
CVEs whose affected-version data names the JTL-WMS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-89310Critical· 9.9A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
▾ MidnightJTL SW GmbH · JTL-WMSEPSS 0.47%via NVD
CVE-2026-89309Critical· 10.0The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed wit…
▾ MidnightJTL SW GmbH · JTL-WMSEPSS 0.39%via NVD