a T-SQL statement without parameterization or escaping, allowing
a remote attacker to execute arbitrary SQL statements in the context of the
application's database account.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| JTL SW GmbH | JTL-WMS | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account. | |
| Title | SQL Command Injection Vulnerability in JTL-WMS | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: ENISA
Published:
Updated: 2026-10-14T06:50:34.005Z
Reserved: 2026-09-11T13:54:43.619Z
Link: CVE-2026-89310
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-14T07:17:04.650
Modified: 2026-10-14T07:17:04.650
Link: CVE-2026-89310
Redhat
No data.
OpenCVE Enrichment
No data.