{"metadata": {"vulnerability": "CVE-2026-103904", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-01T14:12:50.876Z", "date_only": false, "value": "2026-10-01T14:12:50.876Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103904", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T10:23:29.429Z", "date_only": false, "value": "2026-10-14T10:23:29.429Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103904", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T10:23:29.429Z", "date_only": false, "value": "2026-10-14T10:23:29.429Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ENISA", "record": "CVE-2026-103904", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T10:50:05.102Z", "date_only": false, "value": "2026-10-14T10:50:05.102842Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtest7ieo27", "record": "CVE-2026-103904", "field": "creation_timestamp", "uuid": "d5f67418-065f-41e5-b8d6-4ba56fba926a", "content": "CVE-2026-103904 - jtl-shop\nJTL-Shop stores consent names entered by anyone without checking them, and then shows those names on an admin page without protecting the content. A malicious user could place script\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#jtlshop #jtl #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtest7ieo27"}, {"timestamp": "2026-10-14T11:16:58Z", "date_only": false, "value": "2026-10-14T11:16:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XQFJ-GWFJ-J97G", "record": "GHSA-XQFJ-GWFJ-J97G", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T11:16:58.903Z", "date_only": false, "value": "2026-10-14T11:16:58.903", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103904", "record": "FKIE_CVE-2026-103904", "field": "published"}, {"timestamp": "2026-10-14T12:31:33Z", "date_only": false, "value": "2026-10-14T12:31:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XQFJ-GWFJ-J97G", "record": "GHSA-XQFJ-GWFJ-J97G", "field": "published"}, {"timestamp": "2026-10-14T12:31:33Z", "date_only": false, "value": "2026-10-14T12:31:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XQFJ-GWFJ-J97G", "record": "GHSA-XQFJ-GWFJ-J97G", "field": "modified"}, {"timestamp": "2026-10-14T14:11:13.541Z", "date_only": false, "value": "2026-10-14T14:11:13.541111Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103904", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T14:11:13.541Z", "date_only": false, "value": "2026-10-14T14:11:13.541111Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103904", "record": "FKIE_CVE-2026-103904", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T14:11:26.027Z", "date_only": false, "value": "2026-10-14T14:11:26.027Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103904", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:11:26.027Z", "date_only": false, "value": "2026-10-14T14:11:26.027Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103904", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:17:30.413Z", "date_only": false, "value": "2026-10-14T14:17:30.413", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103904", "record": "FKIE_CVE-2026-103904", "field": "lastModified"}, {"timestamp": "2026-10-14T17:57:08.606Z", "date_only": false, "value": "2026-10-14T17:57:08.606988Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440553162356574", "record": "CVE-2026-103904", "field": "creation_timestamp", "uuid": "b4c52082-f118-44c9-9abb-f148f7772c25", "content": "CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop The public consent endpoint of JTL-Shop accepts arbitraryconsent names from unauthenticated visitors without validatingthem against the configured consent items. These names are stored in the consentstatistics and rendered without output encoding in the administrationbackend. An unauthenticated remote attacker can thereby inject script code thatis executed in the browser session of an administrator viewing the consentstatistics page, allowing actions to be performed with the administrator'sprivileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103904https://www.jtl-software.com/de/security/sicherheitsluecke-shop-xss/#JTL-SoftwareGmbH #JTL-Shop#CVE_2026_103904#bot", "url": "https://infosec.exchange/users/cve/statuses/117440553162356574"}]}