27 matches found
CVE-2026-103905
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...
CVE-2026-103904
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...
EUVD-2026-100979
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...
CVE-2026-103905 Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which...
CVE-2026-103905
The JTL-Shop administration backend is vulnerable to an unauthenticated plugin safe mode toggle due to an authentication middleware flaw. The system processes the plugin safe mode toggle on the admin logout route before verifying the user's authentication status. An unauthenticated remote attacke...
EUVD-2026-100973
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...
CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...
CVE-2026-103904
JTL-Shop is vulnerable to a Stored XSS vulnerability because its public consent endpoint accepts arbitrary consent names from unauthenticated visitors without proper validation. These names are stored in consent statistics and rendered in the administration backend without output encoding. An una...
CVE-2026-54390
CVE-2026-54390 — JTL Shop Smarty SSTI Mass Exploit Pre-Auth Contact Form → Email Subject → fetch'string:' → RCE Overview CVE-2026-54390 is a critical CVSS 9.8 unauthenticated Server-Side Template Injection in JTL Shop 5.2.0–5.7.1. The SmartyRenderer::renderTemplate method passes email subject lin...
CVE-2026-54390
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...
CVE-2026-54390 JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...
EUVD-2026-37925
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...
CVE-2026-54390
Technical details are not publicly available in the provided documents. Monitor for updates from the connected sources.
CVE-2026-54390 JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...
CVE-2026-54390: Improper Neutralization of Special Elements Used in a Template Engine
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive...
EUVD-2010-0718
Malware in sbrugna...
kaffee-total.de XSS vulnerability
Open Bug Bounty ID: OBB-594856 Description| Value ---|--- Affected Website:| kaffee-total.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| JTL-Shop Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
JTL-Shop 2 (druckansicht.php) SQL Injection Vulnerability
No description provided by source. JTL-Shop 2 druckansicht.php SQL Injection Vulnerability author : Lo$T Home : www.sa-hacker.com/vbhttp://www.sa-hacker.com/vbhttp://www.sa-hacker.com/vb + www.sec-eviles.com/vbhttp://www.sec-eviles.com/vb email : [email protected]:[email protected] Dork : Powered by...
JTL Shop 2 Remote SQL Injection Exploit
Exploit for php platform in category web applications ======================================= JTL Shop 2 Remote SQL Injection Exploit ======================================= Exploit Title: JTL Shop 2 Date: 01/08/2010 Author: TA4G - email protected Location: Algeria Vendor: www.jtl-software.de...
