CVE-2026-89310 — SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements i…
Published: 2026-10-14 · CVSS: 9.4 · CVSS 4.0
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7