CVE-2026-89310: SQL Command Injection Vulnerability in JTL-WMS
Published Oct 14, 2026
·Updated
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
Affected Software
1 affected component
JTL JTL-WMS
Event History
Oct 14, 2026
CVE Published
via MITRE·06:50 AM
Data Sourced
via MITRE·06:50 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account?
Yes. The CVSS vector indicates low privileges are required (PR:L), so an attacker needs access with at least low-level application privileges. No user interaction is required.
2
What access could an attacker gain through successful exploitation?
An attacker can execute arbitrary SQL statements using the application's database account. The reported impact includes high confidentiality, integrity, and availability impact.