Read the docs
TI-2026-05332 Aliases CVE-2026-6084GHSA-xw72-fqp7-79jm

Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting this vulnerability could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed StockAgile (Novadigits technologies): 25/09/2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Novadigits technologiesStockAgilebefore 25/09/202625/09/2026Patch availableCNA

Remediation

  • Fix · CNA StockAgile (Novadigits technologies) Fixed in 25/09/2026

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Novadigits technologies StockAgile 25/09/2026

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-05336 Stored Cross-Site Scripting in StockAgile by Novadigits technologiesPriority LOW 23
    • TI-2026-05335 Stored Cross-Site Scripting in StockAgile by Novadigits technologiesPriority LOW 23
    • TI-2026-05334 Stored Cross-Site Scripting in StockAgile by Novadigits technologiesPriority LOW 23
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6084
  2. 2026-10-03 Alias added: GHSA-xw72-fqp7-79jm

References

Patch 1

  • TI-2026-05336 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1
  • TI-2026-05335 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1
  • TI-2026-05334 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1
  • TI-2026-05333 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1
  • TI-2026-05331 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1
  • TI-2026-05330 Stored Cross-Site Scripting in StockAgile by Novadigits technologies CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences