Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-89309

Missing Authentication Vulnerability in JTL-WMS

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Jtl-software
Products
Jtl-wms
CVE-2026-89310

SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Jtl-software
Products
Jtl-wms