Cross-Site Scripting Vulnerability in JTL-Shop by JTL Software

CVE-2026-103904

What is CVE-2026-103904?

A significant security flaw exists in JTL-Shop where the public consent endpoint allows unauthenticated users to submit arbitrary consent names without any validation against the configured consent items. This unfiltered input is stored in the consent statistics and displayed without proper output encoding within the administration backend. As a result, an unauthenticated remote attacker can exploit this vulnerability to inject malicious script code. When an administrator accesses the consent statistics page, the injected script executes within their browser session, potentially enabling the attacker to perform actions with the administrator's privileges.

References