XSS in Jtl-Software Gmbh Jtl-Shop

CVE-2026-103904

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.

Vulnerability class: XSS (Cross-Site Scripting)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-103904?
CVE-2026-103904 is a critical-severity vulnerability in Jtl-Software Gmbh Jtl-Shop, classified under Cross-site Scripting. CVSS score: 9.3/10. Published 2026-10-14.
How severe is CVE-2026-103904?
Critical severity. CVSS v3 base score is 9.3 out of 10.