Live › vulnerability › CVE-2026-61804
myTinyWMS is an open-source warehouse management system whose product and category name fields are rendered unescaped in its pages. A logged-in user can save a name containing JavaScript that runs in the browser of any other user who opens those pages, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Teams running myTinyWMS older than 1.6.4 where users can create products or categories. Exposure depends on users with account access; the stored script runs for anyone who later views the affected pages, so administrators and warehouse workers are reached. Installations where only trusted staff have accounts are at lower risk but still exposed to session theft.
No product ranges from the sources yet.
1.6.4.article/index.blade.php and category/index.blade.php in the deployed application.1.6.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product (Artikel) and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including article/index.blade.php and category/index.blade.php. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-61804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.