myTinyWMS prior to version 1.6.4 stores the product or category name without sanitization and renders it with raw Blade output. An authenticated attacker can supply malicious JavaScript through the creation forms, which is then stored in the database. When another user opens the product page or category list, the script executes in that user’s browser context, enabling cross‑user script execution, session hijacking, and potential administrative takeover.

The vulnerability affects the myTinyWMS product in all releases before 1.6.4. Any deployment running those versions is at risk.

With a CVSS score of 8.1 the vulnerability is judged high severity. Exploitation requires the attacker to be authenticated and to create or edit a product or category, but after injection the stored script runs automatically for any user who views the affected page. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that while the attack vector is clear, current exploitation data is limited.