All vulnerabilities
CVE-2026-6088

Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Novadigits technologies StockAgile
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in25/09/2026Fixed versionCVE List
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.

Text from CVE List

Affected versions 1

  • StockAgileaffected: all versions before 25/09/2026CVE List

References 1