{"id":"CVE-2026-61804","kind":"vulnerability","aliases":["CVE-2026-61804"],"related":[],"title":"myTinyWMS: stored script in product and category names hijacks user sessions","description":"myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.","summary":"myTinyWMS is an open-source warehouse management system whose product and category name fields are rendered unescaped in its pages. A logged-in user can save a name containing JavaScript that runs in the browser of any other user who opens those pages, including administrators.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["laravel","mytinywms","package","php","self-hosted","warehouse"],"not_affected_if":["version-1.6.4-or-later"],"how_to_check":"- Check the installed myTinyWMS version; it is affected before `1.6.4`.\n- Look for `article/index.blade.php` and `category/index.blade.php` in the deployed application.","fix":"- Move to `1.6.4` or later.","status":"open","published_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:05+00:00","updated_at":"2026-10-30T17:32:05+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:32:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.6.4` or later.","reach":"network","title":"myTinyWMS: stored script in product and category names hijacks user sessions","impact":"high","summary":"myTinyWMS is an open-source warehouse management system whose product and category name fields are rendered unescaped in its pages. A logged-in user can save a name containing JavaScript that runs in the browser of any other user who opens those pages, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mytinywms","warehouse","self-hosted","php","laravel"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in admin browsers, stealing sessions and enabling takeover","analyst_note":"","how_to_check":"- Check the installed myTinyWMS version; it is affected before `1.6.4`.\n- Look for `article/index.blade.php` and `category/index.blade.php` in the deployed application.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.6.4-or-later"],"who_is_affected":"Teams running myTinyWMS older than 1.6.4 where users can create products or categories. Exposure depends on users with account access; the stored script runs for anyone who later views the affected pages, so administrators and warehouse workers are reached. Installations where only trusted staff have accounts are at lower risk but still exposed to session theft.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4236,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61804':14A,17A '1.6.4':86C,176C 'adequ':97C 'administr':72B,137C,168C 'anoth':131C 'article/index.blade.php':114C 'artikel':88C 'attack':119C 'authent':118C 'backend':98C 'blade':107C 'browser':62B,155C 'categori':7A,38B,90C,128C,143C 'category/index.blade.php':116C 'cell':112C 'contain':56B 'context':156C 'correspond':140C 'creation':126C 'cross':161C 'cross-us':160C 'cve':12A,15A 'dashboard':146C 'databas':103C 'dynam':110C 'enabl':159C 'execut':150C,164C 'field':40B 'fix':173C 'form':129C 'free':76C 'hijack':9A 'host':24B 'includ':71B,113C,133C 'input':123C 'issu':171C 'javascript':57B,149C 'laravel':18B 'list':144C 'log':49B 'logged-in':48B 'malici':122C 'manag':33B,81C,91C 'mytinywm':1A,19B,26B,73C 'name':8A,39B,55B,94C 'open':30B,68B,78C,138C 'open-sourc':29B,77C 'output':108C 'packag':20B 'page':46B,70B 'paramet':95C 'php':21B 'prior':83C 'product':5A,36B,87C,125C,141C 'raw':102C 'render':42B,101C 'run':59B 'sanit':99C 'save':53B,121C 'script':3A,163C 'self':23B 'self-host':22B 'session':11A,165C 'sheet':142C 'sourc':31B,79C 'store':2A,92C,148C 'string':104C 'system':34B,82C 'tabl':111C 'takeov':169C 'theft':166C 'unescap':43B,106C 'user':10A,51B,66B,132C,153C,162C 'version':85C,175C 'warehous':25B,32B,80C 'whose':35B 'without':96C 'worker':135C","nicknames":[],"mitigations":[],"who_affected":"Teams running myTinyWMS older than 1.6.4 where users can create products or categories. Exposure depends on users with account access; the stored script runs for anyone who later views the affected pages, so administrators and warehouse workers are reached. Installations where only trusted staff have accounts are at lower risk but still exposed to session theft.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61804","severity":null,"published_at":"2026-10-30T17:17:27+00:00","modified_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}