CVE-2026-6084

Name of the Vulnerable Software and Affected Versions StockAgile (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) occurs in the API and management panel. The issue exists on the server side within the REST endpoint '/inventory/configuration/variants', where malicious JavaScript code can be injected and persisted via parameters such as code, name, and other text fields. Because the input is not correctly filtered or validated before being displayed on the web panel, a remote authenticated attacker can execute arbitrary JavaScript code in the context of other authenticated users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the code and name parameters in the '/inventory/configuration/variants' endpoint until the issue is resolved.