Threat database

CVE-2026-89310 is a critical SQL injection vulnerability in JTL SW GmbH's JTL-WMS product. It arises because a parameter from the request body is directly inserted into a T-SQL statement without proper parameterization or escaping. This flaw allows a remote attacker to execute arbitrary SQL commands with the application's database privileges. The vulnerability affects multiple versions prior to 2.0.7, 2.1.3, and 2.2.1. The CVSS 4.0 score is 9.4, indicating a high severity with network attack vector and no user interaction required.

JTL SW GmbH JTL-WMS contains an authentication bypass vulnerability in its WMS MobileServer authorization middleware. The middleware fails to require authentication for HTTP methods other than GET and HEAD, and also allows requests with malformed or non-bearer Authorization headers to bypass token validation. This allows remote attackers with network access to invoke API functions without valid credentials. The vulnerability affects versions prior to 2.0.7, 2.1.2, and 2.2.1. The CVSS 4.0 score is 10.0, indicating critical severity.