EUVD-2026-86624
GHSA-phgx-5f2g-mxg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to StockAgile with low-privilege account
-
DeliveryPOST payload to /inventory/configuration/categories code/name field
-
ExploitMalicious JS persisted server-side unsanitized
-
ExecutionVictim authenticated user opens category in panel
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated StockAgile account with permission to write category configuration data via the REST endpoint '/inventory/configuration/categories' (PR:L) - it is not exploitable by anonymous/unauthenticated users. The stored payload only triggers when another authenticated user subsequently views the affected category in the management web panel (UI:P/passive interaction). Impact is limited to JavaScript execution within the victim's authenticated browser session; there is no code execution on the server and no availability impact. This affects StockAgile instances that have not applied the vendor patch. |
| Impact | This is a genuine but modest-severity issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N) yields 5.1 (Medium), and the key limiting factors are consistent across all signals: exploitation requires an already-authenticated account (PR:L) plus victim interaction (UI:P), and impact is confined to low confidentiality/integrity within the browser session (VC:L/VI:L) with no availability or subsequent-system impact. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is best characterized as 'no public exploit identified at time of analysis.' No SSVC data was provided. All signals point the same direction - a stored XSS that needs authenticated write access to the category configuration and a victim viewing the panel - so there is no conflict between CVSS and description. The realistic priority is routine patching rather than urgent response, especially given the niche deployment footprint of StockAgile. |
| Exploit ScenarioDerived | A low-privileged but authenticated StockAgile user submits a category record via the REST endpoint '/inventory/configuration/categories' with a malicious JavaScript payload in the 'code', 'name', or another text field. The payload is stored unsanitized and later executes in the browser of any authenticated user (e.g., an admin) who views that category in the management panel, enabling session-context actions such as cookie/token theft or actions on behalf of the victim. No public proof-of-concept exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user with permission to write category configuration data to persist malicious JavaScript through the REST endpoint '/inventory/configuration/categories' (fields such as 'code' and 'name'). The injected payload is later rendered without proper output encoding in the management web panel, so it executes in the browser session of any authenticated user who views the affected category - a low-privilege, authenticated attacker (PR:L) with passive victim interaction (UI:P) can run script in the victim's session, though impact remains limited to confidentiality and integrity of that session with no server-side code execution or availability loss. Severity is modest (CVSS 5.1, CWE-79); no public exploit code has been identified at time of analysis, and a vendor patch is available per the INCIBE advisory.
RemediationAI
Apply the vendor-released update for StockAgile - INCIBE's advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-stockagile-novadigits-technologies) confirms a patch is available from Novadigits Technologies, and the input/output handling in '/inventory/configuration/categories' is the fix target; do not rely on an older release, since the affected CPE carries no version qualifier. If immediate patching is not possible, reduce exposure by restricting who can write category configuration data (the flaw requires an authenticated account with that permission), reviewing and cleansing existing stored category 'code' and 'name' values to remove any persisted script, and treating the panel as untrusted content. Additional compensating controls with trade-offs include deploying a Content-Security-Policy that blocks inline script execution (effective against this class but may break legitimate inline handlers in the panel), setting session cookies with HttpOnly and SameSite attributes (limits cookie theft but does not stop in-page script actions), and network-restricting management panel access to trusted administrative segments (reduces the victim pool but hampers remote administration). Because there is no availability or server-side execution impact and no public exploit identified at time of analysis, these mitigations are proportionate rather than emergency measures.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 stored (persistent) cross-site scripting flaw rooted in missing server-side input validation and missing output encoding. The StockAgile REST API exposes the endpoint '/inventory/configuration/categories', which accepts text parameters including 'code', 'name', and other descriptive fields; these values are stored in the backend database and subsequently rendered into the management web panel HTML without sanitization or contextual escaping. Because the payload is persisted server-side rather than reflected, every user who later opens the affected category view triggers execution, which is why the assessed CVSS vector rates user interaction as passive (UI:P) rather than active. The CPE cpe:2.3:a:novadigits_technologies:stockagile:*:*:*:*:*:*:*:* indicates the flaw applies across StockAgile releases from vendor Novadigits Technologies with no version qualifier, so it should be treated as affecting all unpatched instances. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms network reachability, low attack complexity, the requirement for an authenticated low-privileged account (PR:L), scope change (S:C) as script escapes into the victim's browser context, and limited confidentiality/integrity impact with no availability impact - there is no path to remote code execution on the server. Note the reported CVSS 4.0 score of 5.1 and vector (PR:L, UI:P) agree with the independent assessment that this is an authenticated, low-severity-to-moderate XSS rather than a critical flaw.
Know when Stockagile gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Network-reachable stored XSS needing an authenticated writer (PR:L) and a victim viewing the panel (UI:R); scope change (S:C) as injected script runs in another user's browser context; low C/I, no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Stockagile
View allStored cross-site scripting in the StockAgile management panel and REST API lets an authenticated user persist arbitrary
Stored cross-site scripting in the StockAgile API and management panel lets a remote authenticated user persist maliciou
Stored cross-site scripting in the StockAgile management panel lets an authenticated user who can write to the REST endp
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user to persist mali
Stored cross-site scripting in StockAgile allows an authenticated low-privileged attacker to inject persistent JavaScrip
Stored cross-site scripting in the StockAgile API and management panel allows an authenticated remote attacker to persis
Exploit-DB