Stored Cross-Site Scripting in StockAgile by Novadigits technologies
API y el panel de gestión de StockAgile.
INCIBE has coordinated the disclosure of seven medium-severity vulnerabilities affecting the API and the StockAgile management dashboard, software for retail stores, e-commerce, and warehouses. The vulnerability was discovered by Miguel Jiménez Cámara.
These vulnerabilities have been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- From CVE-2026-6082 to CVE-2026-6088: 5.1 | CVSS:4.0 /AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CWE-79
No hay solución reportada por el momento.
Stored Cross-Site Scripting (XSS) vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in different REST endpoints that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name’, and other text fields. The scripts that are entered are not filtered or validated correctly before being displayed on the web panel that authenticated users can access. Exploiting these vulnerabilities could allow a remote, previously authenticated attacker to execute arbitrary JavaScript code.
The list of assigned endpoint and identifiers is as follows:
- CVE-2026-6082: endpoint '/inventory/configuration/payment-methods';
- CVE-2026-6083: endpoint '/inventory/configuration/pricing-tiers';
- CVE-2026-6084: endpoint '/inventory/configuration/variants';
- CVE-2026-6085: endpoint '/inventory/configuration/serial-number-types';
- CVE-2026-6086: endpoint '/inventory/configuration/seasons';
- CVE-2026-6087: endpoint '/inventory/configuration/categories';
- CVE-2026-6088: endpoint '/inventory/configuration/brands'.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-6082 | Media | No | Novadigits technologies |
| CVE-2026-6083 | Media | No | Novadigits technologies |
| CVE-2026-6084 | Media | No | Novadigits technologies |
| CVE-2026-6085 | Media | No | Novadigits technologies |
| CVE-2026-6086 | Media | No | Novadigits technologies |
| CVE-2026-6087 | Media | No | Novadigits technologies |
| CVE-2026-6088 | Media | No | Novadigits technologies |
