myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product (Artikel) and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including article/index.blade.php and category/index.blade.php. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…inyWMS/security/advisories/GHSA-gw9m-vphv-gxm5 Diğer
• github.com/…ommit/a01af6bb0e8f4013125c47c795a4736e7cbac7ec Diğer
• github.com/myTinyWMS/myTinyWMS/tree/v1.6.4 Diğer

Kayıt geçmişi

1. 30 Eki 2026 20:04Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-39739WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
• 6,8 CVE-2026-119764Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
• 6,1 CVE-2026-119761Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
• 6,4 CVE-2026-119113GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
• 5,4 CVE-2026-109984FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
• 6,4 CVE-2026-115869Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field