SQL Injection Vulnerability in Application Database by Vendor
CVE-2026-89310

9.4CRITICAL

Key Information:

Vendor

Jtl Sw Gmbh

Status
Jtl-wms
Vendor
CVE Published:
14 October 2026

What is CVE-2026-89310?

A vulnerability exists due to the improper handling of parameters from the request body in T-SQL statements. This flaw allows remote attackers to exploit the application, leading to the execution of arbitrary SQL commands within the application's database environment. The lack of parameterization or escaping increases the risk significantly, jeopardizing sensitive data and overall application security.

Affected Version(s)

JTL-WMS 0 < 2.0.7

JTL-WMS 0 < 2.1.3

JTL-WMS 0 < 2.2.1

References

https://www.jtl-software.com/de/cve-2026-89309-cve-2026-8...
vendor-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.