CVE-2026-6084 in StockAgile
Summary
by MITRE • 09/25/2026
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The identified security flaw represents a classic Stored Cross-Site Scripting vulnerability within the StockAgile application infrastructure, specifically targeting both its REST API and associated management panel interface. This type of vulnerability is characterized by an application accepting untrusted data from users via input fields such as code or name parameters on the server-side endpoint /inventory/configuration/variants, failing to properly sanitize this information before storing it in a persistent storage medium like a database. When other authenticated users subsequently access the web management panel and view content derived from these stored inputs, the malicious JavaScript payload is rendered by their browsers without proper encoding or filtering mechanisms. This persistence distinguishes Stored XSS from Reflected variants, as the attack vector remains active on the server until the compromised data is manually removed or expires, thereby increasing the potential blast radius of a single successful exploitation event across multiple user sessions and administrative contexts.
From a technical perspective, the root cause lies in insufficient input validation and output encoding practices within the application logic handling variant configurations. The system accepts text-based parameters without applying strict allow-listing strategies to filter out special characters or script tags that could be interpreted as executable code by client-side browsers. Furthermore, the absence of Content Security Policy directives or robust server-side escaping mechanisms allows injected scripts to execute in the context of the victim user's session. This failure aligns directly with CWE-79, which categorizes improper neutralization of input during web page generation, and is further contextualized within the MITRE ATT&CK framework under techniques such as T1059 Command and Scripting Interpretation or potentially T1189 Drive-by Compromise if used in conjunction with other vectors. The vulnerability effectively bypasses standard authentication controls because it exploits trusted sessions of legitimate users rather than attempting to break into the system directly through network-level attacks.
The operational impact of this vulnerability is severe, particularly given that the affected endpoint manages inventory configurations which are likely accessed by administrators or operations staff with elevated privileges. An attacker who successfully injects malicious scripts can perform a variety of destructive actions including session hijacking, where stolen cookies and authentication tokens allow the adversary to impersonate legitimate users and gain unauthorized access to sensitive business data. Additionally, the attacker could execute arbitrary commands within the user's browser context, potentially leading to keylogging activities that capture credentials for other systems or defacement of the management interface. In enterprise environments, this can result in significant financial loss, reputational damage, and regulatory non-compliance due to the exposure of confidential inventory data or customer information through compromised administrative accounts.
Mitigation strategies must focus on implementing defense-in-depth measures starting with rigorous input validation at the API layer. Developers should enforce strict allow-listing for all text fields accepting variant configurations, ensuring that only expected alphanumeric characters and specific safe symbols are permitted while rejecting any HTML tags, script elements, or event handlers. Simultaneously, output encoding is critical; all user-supplied data rendered in web pages must be contextually encoded to prevent browser interpretation as executable code. Implementing a robust Content Security Policy header can further mitigate the impact by restricting the sources from which scripts are allowed to load and execute. Additionally, introducing automated security testing within the CI/CD pipeline using static application security testing tools will help detect such injection flaws early in the development lifecycle before they reach production environments.