Jetimpex Inc. vulnerabilities and threats

CVE-2026-54189 is a high-severity vulnerability in Jetimpex Inc.'s JetEngine product, affecting versions up to and including 3.8.10. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. The vulnerability can be triggered without authentication and impacts confidentiality, integrity, and availability to a limited extent.

CVE-2026-54188 is a high-severity vulnerability in Jetimpex Inc.'s JetEngine product, affecting versions up to and including 3.8.10. It is an unauthenticated Cross-Site Scripting (XSS) vulnerability that allows improper neutralization of input during web page generation. The vulnerability can be triggered without authentication and impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-54187 is a critical unauthenticated SQL Injection vulnerability affecting Jetimpex Inc.'s JetEngine product versions up to and including 3.8.10.1. This flaw allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and apply fixes once released.

CVE-2026-52706 is a critical vulnerability in Jetimpex Inc.'s JetEngine product affecting versions up to and including 3.8.10. It involves unauthenticated PHP object injection, classified under CWE-502 (Deserialization of Untrusted Data). The vulnerability allows remote attackers to execute arbitrary code without any authentication. The CVSS v3.1 base score is 9.8, indicating high impact on confidentiality, integrity, and availability.

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

CVE-2026-49084 is a critical unauthenticated SQL Injection vulnerability affecting Jetimpex Inc.'s JetEngine versions prior to 3.8.9.1. This vulnerability allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS 3.1 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor. Users of affected versions should monitor vendor advisories for updates and apply patches once available.

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

CVE-2026-49074 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Jetimpex Inc.'s JetEngine affecting versions up to and including 3.8.9.1. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The vulnerability is identified as CWE-79, indicating improper neutralization of input. No official patch or remediation guidance is currently provided by the vendor.

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.