JTL-Software vulnerabilities
We track 3 vulnerabilities in JTL-Software products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest JTL-Software vulnerabilities
- 7.5 High severity
JTL-Shop: Missing Authentication for Critical Functionality
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop'
- 9.3 Critical severity
JTL-Shop: Improper Neutralization of Input During Web Page Generation
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the adm
- 9.8 Critical severity
JTL Shop: Improper Neutralization of Special Elements Used in a Template Engine
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can e