All vulnerabilities
CVE-2026-89310

SQL Command Injection Vulnerability in JTL-WMS

JTL SW GmbH JTL-WMS
Open in ThreatlineRecord JSON
CVSS
9.4Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.7Also 2.1.3, 2.2.1CVE List
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

Text from CVE List

Affected versions 4

  • JTL-WMSaffected: all versions before 2.0.7CVE List
  • JTL-WMSaffected: all versions before 2.1.3CVE List
  • JTL-WMSaffected: all versions before 2.2.1CVE List
  • JTL-WMSaffected: 1.7.*, 1.8.*, 1.9.*, 1.10.*, 1.11.*CVE List

References 1