StockAgile CVE-2026-6085

Requires a valid authenticated account on the StockAgile management panel (PR:L) with access to write to the REST endpoint '/inventory/configuration/serial-number-types' via injectable text parameters such as 'code' and 'name'. Exploitation is not self-contained: a second authenticated user (UI:P/passive) must subsequently load the affected panel view for the stored script to execute in their browser. Limiting factors are the mandatory authentication barrier, the need for a victim to view the poisoned configuration, and browser-scoped (client-side) impact only - there is no server-side code execution or availability impact.

This is a genuine but modest-severity issue, not a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N, base 5.1 MEDIUM) shows two meaningful brakes on real-world risk: PR:L means the attacker must already hold a valid authenticated account in the StockAgile management panel, and UI:P means a second user must passively load the poisoned panel view for the payload to fire. Impact is limited (VC:L/VI:L, VA:N) - consistent with browser-context script execution rather than server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; absence of these signals plus the authentication requirement argues against opportunistic mass exploitation. The realistic threat is an insider or an attacker who has phished/obtained one low-privilege account using stored XSS to pivot against higher-privilege panel users (e.g. session/credential theft or actions-in-context). A patch is available from the vendor, which is the decisive mitigation. Net: a legitimate defect worth patching on a normal cycle, not a drop-everything item.

An attacker with a low-privilege authenticated StockAgile account submits a serial-number-type via the REST endpoint '/inventory/configuration/serial-number-types', placing malicious JavaScript in the 'code' or 'name' text field. The payload is stored unsanitized and later executes in the browser of any authenticated user (e.g. an admin) who views that configuration in the management panel, enabling session-context actions or credential theft. No public exploit code is identified at the time of analysis.