CVE-2026-103904

Deferred Deferred - Pending Action

Stored XSS in JTL-Shop Consent Statistics

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: ENISA

Description

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103904

EUVD

EUVD-2026-100973

Affected Vendors & Products

Vendor	Product	Version / Range
JTL-Software	GmbH	JTL-Shop 5.4.0
JTL-Software	GmbH	JTL-Shop 5.7.0
JTL-Software	GmbH	JTL-Shop 5.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in JTL-Shop where unauthenticated attackers can inject malicious script code into consent names. The injected code executes in the browser of an administrator viewing the consent statistics page, allowing actions to be performed with admin privileges.

Detection Guidance

Check if your JTL-Shop version is between 5.4.0-5.6.4, 5.7.0-5.7.4, or 5.8.0-5.8.1. Inspect the consent statistics page in the backend for unusual or unexpected script-like content in consent names. Look for entries that do not match configured consent items.

Manually review database entries in the consent statistics table for arbitrary or malicious-looking consent names. Use SQL queries to search for entries with HTML or JavaScript patterns like <script>, onerror=, or javascript:.

Impact Analysis

An attacker could perform actions with administrator rights such as changing settings, creating user accounts, or installing plugins. This could lead to full system compromise, data theft, or further attacks on the system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if exposed. Both standards require protection against unauthorized access and data integrity.

Mitigation Strategies

Update JTL-Shop to version 5.6.5, 5.7.5, or 5.8.2 immediately. If updating is not possible, apply the provided patch files. Remove any already stored manipulated consent entries from the database manually.

As a temporary measure, restrict access to the consent statistics page in the backend or revoke unnecessary admin privileges until the update is completed. Avoid opening the consent statistics page until mitigation is applied.

Hi! I’m here to help you understand CVE-2026-103904. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70