CVE-2026-89310 — SQL Command Injection Vulnerability in JTL-WMS

CVE-2026-89310

SQL Command Injection Vulnerability in JTL-WMS PUBLISHED

Description (CNA)

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

Affected (CNA)

Vendor / product	Versions
JTL SW GmbH / JTL-WMS	affected 0 before 2.0.7; affected 0 before 2.1.3; affected 0 before 2.2.1; affected 1.7., 1.8., 1.9., 1.10., 1.11.*

CWE

CWE-89

References

https://www.jtl-software.com/de/cve-2026-89309-cve-2026-89310

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.