Jtl Wms
Monthly
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.