StockAgile CVE-2026-6088

Exploitation requires a valid authenticated StockAgile account (PR:L) able to reach the REST endpoint '/inventory/configuration/categories' and submit category fields such as 'code' or 'name', which are stored without proper filtering/validation. Firing the payload additionally requires a second authenticated user to view the affected data in the management web panel (UI:P/passive interaction). Limiting factors: attacker must already be authenticated, the injected script only executes when a victim loads the poisoned category view, and impact is confined to the browser session of panel users; a vendor patch is available which removes the condition once applied.

This is a moderate-severity stored XSS with a self-reported CVSS 4.0 base score of 5.1 (AV:N/AC:L/PR:L/UI:P/VC:L/VI:L). The key risk-limiting signals are PR:L (attacker must already hold a valid authenticated account on the StockAgile panel) and UI:P (a separate authenticated user must view the poisoned category data for the payload to fire). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so this is 'no public exploit identified at time of analysis.' The impact is bounded to low confidentiality and low integrity within the web session (session/token theft, UI manipulation, actions in the victim's context) with no availability impact. There is no conflict between the vector and the description - both point to authenticated, network-delivered, victim-view-dependent exploitation. Net assessment: a real but not urgent issue - a vendor patch exists and should be applied, but the authentication requirement plus required victim interaction and niche product footprint keep real-world mass-exploitation risk low relative to the CVSS number.

A low-privileged but authenticated StockAgile user submits a category via the REST endpoint '/inventory/configuration/categories' with a malicious script in the 'code' or 'name' field. The payload is persisted server-side and later rendered unsanitized when another authenticated user (e.g., an administrator) opens the management panel, executing attacker JavaScript in that user's session to steal tokens or perform actions on their behalf. No public proof-of-concept is identified in the provided data.