Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-89310

SQL Command Injection Vulnerability in JTL-WMS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ENISA

Description

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

JTL SW GmbH JTL-WMS

Default version status: unaffected

  • 0 to < 2.0.7affected
  • 0 to < 2.1.3affected
  • 0 to < 2.2.1affected
  • 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*affected

References