Stockagile
Monthly
Stored cross-site scripting in the StockAgile management panel and REST API lets an authenticated user persist arbitrary JavaScript through category fields, which then executes in the browser of any other authenticated user who views the poisoned category view. The flaw affects the '/inventory/configuration/categories' REST endpoint, where parameters such as 'code' and 'name' are stored without adequate filtering or validation before being rendered in the web panel. Exploitation requires a valid StockAgile account and passive interaction from a second panel user, so impact is confined to the victim's browser session; no KEV entry or public exploit code was identified at time of analysis, and a vendor patch is available. The self-reported CVSS 4.0 base score is 5.1 (AV:N/AC:L/PR:L/UI:P), consistent with our independent CVSS 3.1 assessment of 5.1.
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user with permission to write category configuration data to persist malicious JavaScript through the REST endpoint '/inventory/configuration/categories' (fields such as 'code' and 'name'). The injected payload is later rendered without proper output encoding in the management web panel, so it executes in the browser session of any authenticated user who views the affected category - a low-privilege, authenticated attacker (PR:L) with passive victim interaction (UI:P) can run script in the victim's session, though impact remains limited to confidentiality and integrity of that session with no server-side code execution or availability loss. Severity is modest (CVSS 5.1, CWE-79); no public exploit code has been identified at time of analysis, and a vendor patch is available per the INCIBE advisory.
Stored cross-site scripting in the StockAgile API and management panel lets a remote authenticated user persist malicious JavaScript into the REST endpoint '/inventory/configuration/serial-number-types' through text parameters such as 'code' and 'name', which the server fails to validate or encode before rendering them back in the web panel. The payload executes in the browser of any authenticated operator who subsequently opens the affected panel view, in the context of that user's session, but it does not compromise the server itself. Exploitation is not unauthenticated: the CVSS 4.0 vector reports PR:L, so the attacker must already hold a valid account with write access to that endpoint, and the impact stays within the victim's browser context (VC:L/VI:L/VA:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and while a vendor patch is available, the issue is best handled as routine-priority patching rather than an emergency given its low severity and privilege prerequisites.
Stored cross-site scripting in the StockAgile management panel lets an authenticated user who can write to the REST endpoint '/inventory/configuration/serial-number-types' persist malicious JavaScript through the 'code', 'name' and other text fields, which is then served unescaped and executes in the browser of any other authenticated user who later opens the poisoned configuration view. Exploitation is not self-contained: the CVSS vector marks the attacker as authenticated (PR:L) and requires a second user to passively load the affected panel, so impact stays client-side with no server-side code execution or availability loss. The vendor has issued a patch through the INCIBE advisory, and no public exploit identified at time of analysis; severity is assessed as modest rather than emergency-level given the authentication barrier and the need for a victim to view the injected configuration.
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user to persist malicious JavaScript into product-variant records via the REST endpoint '/inventory/configuration/variants'. Because the 'code', 'name', and other text fields are not sanitized before being rendered in the web management panel, the injected script executes in the browser of any authenticated operator who later views the affected configuration page, enabling session hijacking or panel actions in that user's context. Exploitation requires a valid panel account plus a second authenticated user to trigger rendering, no public exploit code has been identified at time of analysis, and a vendor patch is already available, making this a moderate rather than urgent priority.
Stored cross-site scripting in StockAgile allows an authenticated low-privileged attacker to inject persistent JavaScript through text fields such as code and name in the REST endpoint /inventory/configuration/pricing-tiers, which is then rendered in the management panel for other authenticated users. Exploitation requires a valid StockAgile account to write the payload and a second authenticated user to view the affected pricing-tier data, with impact limited to script execution in the panel's browser context and no availability impact. The issue is assessed as a moderate, not urgent, priority; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation.
Stored cross-site scripting in the StockAgile API and management panel allows an authenticated remote attacker to persist arbitrary JavaScript into payment-method configuration records via the REST endpoint '/inventory/configuration/payment-methods', using text parameters such as 'code' and 'name' that are neither validated nor encoded before being rendered back to users. Because the injected script only fires when a second authenticated user opens the affected configuration in the web panel (CVSS UI:P / UI:R), exploitation requires both an attacker account with access to the payment-method configuration feature and a victim who views the poisoned data, and impact is confined to the victim's browser session. No public exploit code has been identified at time of analysis, and the vendor has published a fix. This is a genuine but low-priority stored XSS.
Stored cross-site scripting in the StockAgile management panel and REST API lets an authenticated user persist arbitrary JavaScript through category fields, which then executes in the browser of any other authenticated user who views the poisoned category view. The flaw affects the '/inventory/configuration/categories' REST endpoint, where parameters such as 'code' and 'name' are stored without adequate filtering or validation before being rendered in the web panel. Exploitation requires a valid StockAgile account and passive interaction from a second panel user, so impact is confined to the victim's browser session; no KEV entry or public exploit code was identified at time of analysis, and a vendor patch is available. The self-reported CVSS 4.0 base score is 5.1 (AV:N/AC:L/PR:L/UI:P), consistent with our independent CVSS 3.1 assessment of 5.1.
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user with permission to write category configuration data to persist malicious JavaScript through the REST endpoint '/inventory/configuration/categories' (fields such as 'code' and 'name'). The injected payload is later rendered without proper output encoding in the management web panel, so it executes in the browser session of any authenticated user who views the affected category - a low-privilege, authenticated attacker (PR:L) with passive victim interaction (UI:P) can run script in the victim's session, though impact remains limited to confidentiality and integrity of that session with no server-side code execution or availability loss. Severity is modest (CVSS 5.1, CWE-79); no public exploit code has been identified at time of analysis, and a vendor patch is available per the INCIBE advisory.
Stored cross-site scripting in the StockAgile API and management panel lets a remote authenticated user persist malicious JavaScript into the REST endpoint '/inventory/configuration/serial-number-types' through text parameters such as 'code' and 'name', which the server fails to validate or encode before rendering them back in the web panel. The payload executes in the browser of any authenticated operator who subsequently opens the affected panel view, in the context of that user's session, but it does not compromise the server itself. Exploitation is not unauthenticated: the CVSS 4.0 vector reports PR:L, so the attacker must already hold a valid account with write access to that endpoint, and the impact stays within the victim's browser context (VC:L/VI:L/VA:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and while a vendor patch is available, the issue is best handled as routine-priority patching rather than an emergency given its low severity and privilege prerequisites.
Stored cross-site scripting in the StockAgile management panel lets an authenticated user who can write to the REST endpoint '/inventory/configuration/serial-number-types' persist malicious JavaScript through the 'code', 'name' and other text fields, which is then served unescaped and executes in the browser of any other authenticated user who later opens the poisoned configuration view. Exploitation is not self-contained: the CVSS vector marks the attacker as authenticated (PR:L) and requires a second user to passively load the affected panel, so impact stays client-side with no server-side code execution or availability loss. The vendor has issued a patch through the INCIBE advisory, and no public exploit identified at time of analysis; severity is assessed as modest rather than emergency-level given the authentication barrier and the need for a victim to view the injected configuration.
Stored cross-site scripting in the StockAgile inventory management platform allows an authenticated user to persist malicious JavaScript into product-variant records via the REST endpoint '/inventory/configuration/variants'. Because the 'code', 'name', and other text fields are not sanitized before being rendered in the web management panel, the injected script executes in the browser of any authenticated operator who later views the affected configuration page, enabling session hijacking or panel actions in that user's context. Exploitation requires a valid panel account plus a second authenticated user to trigger rendering, no public exploit code has been identified at time of analysis, and a vendor patch is already available, making this a moderate rather than urgent priority.
Stored cross-site scripting in StockAgile allows an authenticated low-privileged attacker to inject persistent JavaScript through text fields such as code and name in the REST endpoint /inventory/configuration/pricing-tiers, which is then rendered in the management panel for other authenticated users. Exploitation requires a valid StockAgile account to write the payload and a second authenticated user to view the affected pricing-tier data, with impact limited to script execution in the panel's browser context and no availability impact. The issue is assessed as a moderate, not urgent, priority; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation.
Stored cross-site scripting in the StockAgile API and management panel allows an authenticated remote attacker to persist arbitrary JavaScript into payment-method configuration records via the REST endpoint '/inventory/configuration/payment-methods', using text parameters such as 'code' and 'name' that are neither validated nor encoded before being rendered back to users. Because the injected script only fires when a second authenticated user opens the affected configuration in the web panel (CVSS UI:P / UI:R), exploitation requires both an attacker account with access to the payment-method configuration feature and a victim who views the poisoned data, and impact is confined to the victim's browser session. No public exploit code has been identified at time of analysis, and the vendor has published a fix. This is a genuine but low-priority stored XSS.