The vulnerability is a stored cross‑site scripting flaw in StockAgile’s API and management panel. Parameters such as ‘code’ and ‘name’ are accepted on the server side without proper sanitisation and are persisted, then rendered in the web panel where authenticated users view them. A remote attacker who has already authenticated can inject JavaScript that will execute in the victim’s browser whenever the stored data is displayed, enabling credential theft, session hijacking, or further attack steps. This flaw does not provide server‑side code execution, but it does enable malicious client‑side behaviour that can impact many users. The weakness is classified as CWE‑79. The impact therefore centres on confidentiality, integrity, and availability of user sessions and data within the application.

Novadigits technologies StockAgile, the vulnerability exists in the REST endpoint /inventory/configuration/pricing‑tiers that is part of both the API and the web‑based management panel. No specific product versions are listed in the advisory; the flaw is present in the stock product as currently released.

The CVSS score of 5.1 indicates moderate threat potential. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation in the wild. The attack vector requires that the attacker first authenticate to the StockAgile portal; once this threshold is met, they can inject the malicious payload. As the vulnerability is client‑side, the breadth of impact depends on the number of authenticated users that view the compromised pricing‑tier data. While the exploit is not trivial, it does not require administrative or kernel permissions, and exploiting it can lead to significant damage via client‑side code execution.