myTinyWMS CVE-2026-61804

Requires an authenticated myTinyWMS account with permission to create or edit products (Artikel) or categories - the attacker saves JavaScript into the name field, which is stored without back-end sanitization. The payload only executes when a second authenticated user (worker or administrator) subsequently loads a view that renders the value through unescaped Blade {!! !!} output - specifically article/index.blade.php, category/index.blade.php, the product sheet (e.g. /article/1), the category admin listing, or the dashboard. Exploitation is therefore limited by: the need for an authenticated foothold, the requirement that a victim open the affected page (UI:R), and the fact that impact escalates to takeover only if the viewing victim holds higher privileges. The complete fix is upgrading to version 1.6.4; no partial mitigation is stated by the vendor.

This is a stored (persistent) XSS flaw (CWE-79) rated CVSS 8.1. The supplied vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N indicates network reach, low complexity, a changed scope (attacker's injected script runs in a victim's authenticated session), and high confidentiality/integrity impact with no availability impact. The UI:R flag correctly reflects that a second user must open the poisoned product sheet, category listing or dashboard for the payload to fire - exploitation is not instantaneous or self-contained. I disagree with the input's PR:H: both the NVD description and the GHSA advisory state that any authenticated user (including an ordinary worker profile) can save the payload through standard product-creation or category forms, which is operationally PR:L, not an administrative prerequisite; this materially lowers the barrier versus what PR:H implies. No EPSS score, no CISA KEV listing, and no 'confirmed working exploit' flag are present in the input, so there is no signal of active exploitation; the GHSA advisory does, however, include a step-by-step PoC with a concrete payload. The vuln.today decision label is 'this_week' (not act_now/emergency). Net: a genuine, easily-triggered stored XSS with a credible admin-takeover path, but its real-world urgency is tempered by the required authenticated foothold, the need for victim interaction, the absence of any exploitation-in-the-wild signal, and the product's small deployment footprint.

A low-privileged but authenticated myTinyWMS user (e.g. a warehouse worker) creates or edits a product or category and stores a crafted payload such as <IMG "">><SCRIPT>alert('xss')</SCRIPT> in the name field, which is saved without back-end sanitization. When an administrator later opens the article index, category listing or dashboard, the unescaped Blade output ({!! $variable !!}) renders the raw string and the script executes in the admin's session, enabling session theft and account takeover. A public PoC with exact steps and a filter-evading payload is published in the GHSA advisory.