Threat database

CVE-2026-103905 is a vulnerability in the JTL-Shop administration backend where the plugin safe mode toggle can be accessed without authentication. This allows an unauthenticated remote attacker to enable or disable the shop's plugin safe mode, effectively deactivating all installed plugins including payment and shipping integrations. The vulnerability leads to a denial of service affecting the entire shop. It requires only a single request and can be automated against multiple installations.

CVE-2026-103904 is a high-severity cross-site scripting (XSS) vulnerability in JTL-Shop by JTL-Software GmbH. The issue arises because the public consent endpoint accepts arbitrary consent names from unauthenticated users without validation. These names are stored and later rendered without proper output encoding in the administration backend. This allows an unauthenticated attacker to inject malicious script code that executes in the browser session of an administrator viewing the consent statistics page, potentially enabling actions with administrator privileges.