CVE-2026-61804

Name of the Vulnerable Software and Affected Versions myTinyWMS versions prior to 1.6.4

Description Stored cross-site scripting occurs because the name parameter in Product (Artikel) and Category management is stored without adequate backend sanitization. The application renders raw database strings through unescaped Blade output in dynamic table cells, specifically within article/index.blade.php and category/index.blade.php. An authenticated attacker can inject malicious JavaScript via product creation or category forms. When other users, such as workers or administrators, view the product sheet, category listing, or dashboard, the script executes in their browser context, potentially leading to session theft and administrative takeover.

Recommendations Update to version 1.6.4.