jtl_shop vulnerabilities

CVEs whose affected-version data names the jtl_shop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-54390Critical· 9.8PoC

4mo ago

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template …

▾ AbyssalJTL Software · JTL ShopEPSS 0.60%via CVEORG