CVE-2026-6088

Name of the Vulnerable Software and Affected Versions StockAgile (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious JavaScript code can be injected and persisted via the code and name parameters, as well as other text fields. This happens because input is not correctly filtered or validated before being displayed to authenticated users on the web panel. A remote, authenticated attacker could exploit this to execute arbitrary JavaScript code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the code and name parameters in the '/inventory/configuration/categories' endpoint until the issue is resolved.