JTL-WMS vulnerabilities

2 known vulnerabilities in JTL-WMS from JTL SW. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  JTL-WMS: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-89310Oct 14, 2026JTL SW

  A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

• 10.0 Critical severity

  JTL-WMS: Missing Authentication for Critical Functionality

  CVE-2026-89309Oct 13, 2026JTL SW

  The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication