CVE-2026-6083: Stored Cross-Site Scripting in StockAgile by Novadigits technologies
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A remote attacker must already be authenticated to the StockAgile API or management panel. The vulnerable REST endpoint is /inventory/configuration/pricing-tiers.
Which inputs are implicated?
The affected endpoint accepts malicious script content through parameters including code, name, and other text fields. The submitted content can persist and later be rendered in the web panel.
Who is exposed to the stored payload?
Authenticated users who access the management panel and view the persisted data may execute the injected JavaScript in their browsers. The issue results from insufficient filtering or validation before display.