CVE-2026-103904

{
  "etk_id": "ETK-2026-1562",
  "cve_id": "CVE-2026-103904",
  "display_id": "CVE-2026-103904",
  "ghsa_id": "GHSA-xqfj-gwfj-j97g",
  "euvd_id": "EUVD-2026-100973",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in JTL-Shop consent statistics",
  "summary": "Affected JTL-Shop installations can retain attacker-controlled consent-statistics labels that are unsafe when displayed in the administration interface. An unauthenticated remote attacker may execute code in an administrator's browser if an administrator opens the affected statistics view.",
  "mitigation": "Upgrade JTL-Shop to 5.6.5, 5.7.5, or 5.8.2, as appropriate for the deployed release line. Until upgraded, restrict access to the administration interface and avoid opening untrusted consent-statistics data.",
  "vendor": "JTL-Software GmbH",
  "product": "JTL-Shop",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 5.4.0, < 5.6.5",
        ">= 5.7.0, < 5.7.5",
        ">= 5.8.0, < 5.8.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.6.5",
        "5.7.5",
        "5.8.2"
      ],
      "package_name": "JTL-Shop",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N",
  "epss_score": 0.004,
  "epss_percentile": 0.3322,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 44.50826816666667,
  "t0_at": "2026-10-14T10:23:29.429000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T10:23:29.429000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T10:23:29.429000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103904"
    }
  }
}