Mytinywms
Monthly
Stored cross-site scripting in myTinyWMS allows any authenticated user who can create or edit products (Artikel) or categories to persist JavaScript in the `name` field, which then executes in the browser of every worker or administrator who opens the affected product sheet, category listing or dashboard. The value is written to the database without back-end sanitization and rendered back through unescaped Blade output in dynamic table cells, so a single saved entry becomes a cross-user execution vector that can support session theft and administrative takeover when the victim holds higher privileges. Exploitation requires an authenticated foothold with product/category write permission and a victim who loads an affected view (UI:R), which keeps this at CVSS 8.1 rather than an unauthenticated compromise; the issue is fixed in version 1.6.4, and a working PoC payload with step-by-step reproduction is published in the vendor's GitHub security advisory.
Stored cross-site scripting in myTinyWMS allows any authenticated user who can create or edit products (Artikel) or categories to persist JavaScript in the `name` field, which then executes in the browser of every worker or administrator who opens the affected product sheet, category listing or dashboard. The value is written to the database without back-end sanitization and rendered back through unescaped Blade output in dynamic table cells, so a single saved entry becomes a cross-user execution vector that can support session theft and administrative takeover when the victim holds higher privileges. Exploitation requires an authenticated foothold with product/category write permission and a victim who loads an affected view (UI:R), which keeps this at CVSS 8.1 rather than an unauthenticated compromise; the issue is fixed in version 1.6.4, and a working PoC payload with step-by-step reproduction is published in the vendor's GitHub security advisory.