CVE-2026-103905 is an unauthenticated plugin safe mode toggle vulnerability in JTL-Shop. An attacker can switch the shop's plugin safe mode on and off, deactivating all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. This vulnerability allows for potential shop-wide denial of service and impacts payment and shipping integrat [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-14T10:23:29.429Z and has not been modified since then. The stored XSS vulnerability in JTL-Shop allows an unauthenticated remote attacker to inject script code that can be executed in the browser session of an administrator, potentially leading to actions being performed with the administrator's pri [truncated]
