StockAgile CVE-2026-6086

Exploitation requires: (1) a valid authenticated account on the StockAgile management panel with permission to write to the REST endpoint '/inventory/configuration/serial-number-types' (PR:L); and (2) a second authenticated user subsequently viewing the panel page that renders the stored 'code', 'name', or other text-field values, satisfying the UI:P/passive-interaction requirement. The injection point is server-side input validation/output-encoding failure on those text parameters. Limiting factors: the attacker cannot exploit this unauthenticated, the payload only fires when an authenticated victim loads the affected panel view, and impact is confined to the victim's browser context (no direct server compromise, VA:N/no availability impact).

This is a genuine but modest-severity issue best treated as routine-priority patching rather than an emergency. The vendor-provided CVSS 4.0 vector (5.1, Medium) is internally consistent with the description: AV:N (the REST endpoint '/inventory/configuration/serial-number-types' is network-reachable), AC:L, PR:L (attacker must already be an authenticated panel user), and UI:P (a victim user must later view the affected panel page for the stored payload to fire). Impact is limited to VC:L/VI:L with VA:N and no subsequent-system impact (SC/SI/SA:N), which is appropriate for a script-context stored XSS confined to the browser session of authenticated users. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The main real-world limiter is the PR:L requirement - an attacker needs valid credentials to inject, making this most relevant as a privilege-escalation/lateral-movement primitive among authenticated users (e.g., a low-privileged operator attacking an admin) rather than an internet-wide unauthenticated threat. No signals conflict; all point to a real-but-contained, authentication-gated flaw.

A low-privileged but authenticated StockAgile user submits a serial-number-type record via the REST API with a malicious JavaScript payload in a text field such as 'code' or 'name'. The unsanitized value is persisted server-side and later rendered in the management panel, so when a higher-privileged authenticated user (e.g., an administrator) views that configuration screen, the script executes in their browser session. No public exploit code was provided in the intelligence sources.