CVE-2026-6088: Stored Cross-Site Scripting in StockAgile by Novadigits technologies
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must already be authenticated to StockAgile. They can submit malicious JavaScript through the category configuration REST endpoint, including fields such as code and name.
Which users are at risk from stored payloads?
Authenticated users who access the management panel are exposed when the panel displays the unfiltered stored content. The supplied information does not identify particular roles or permissions beyond authentication.
How can defenders identify potential exposure?
Review data submitted to /inventory/configuration/categories, particularly category code, name, and other text fields, for suspicious JavaScript or markup. Also inspect management-panel views that render category configuration content for unexpected script execution.