{"id":"CVE-2026-103904","published":"2026-10-14T11:16:58.903","lastModified":"2026-10-16T20:04:29.760","description":"The public consent endpoint of JTL-Shop accepts arbitrary\nconsent names from unauthenticated visitors without validating\nthem against the configured consent items. These names are stored in the consent\nstatistics and rendered without output encoding in the administration\nbackend. An unauthenticated remote attacker can thereby inject script code that\nis executed in the browser session of an administrator viewing the consent\nstatistics page, allowing actions to be performed with the administrator's\nprivileges.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.jtl-software.com/de/security/sicherheitsluecke-shop-xss/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The JTL-Shop consent endpoint allows unauthenticated users to inject arbitrary script code into consent statistics, which executes in administrators' browsers when viewing admin pages. This cross-site scripting vulnerability can lead to full administrative compromise.","exploitability":"Exploitation requires an unauthenticated attacker to submit malicious consent names via the public endpoint, with no additional preconditions needed for the initial injection, though administrator interaction is required to view the compromised statistics page.","blast_radius":"The vulnerability could impact all JTL-Shop installations with public consent endpoints, potentially allowing attackers to hijack administrator sessions and perform privileged actions like modifying shop settings, managing users, or accessing sensitive data.","remediation":"Disable the public consent endpoint or implement strict validation of consent names against configured items before storing them in statistics, as no fixed version has been published yet.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","admin","session"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:55:40.883Z"}}