CVE-2025-57204: Stocky POS · Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 22 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Immediate mitigation should focus on input validation and output encoding: Implement strict server-side input sanitization on the product name parameter to neutralize HTML and JavaScript code before storage.
- Apply context-aware output encoding when rendering product names in the UI to prevent script execution.
- Introduce or strengthen Content Security Policy (CSP) headers to restrict the execution of inline scripts and loading of untrusted resources, significantly reducing XSS exploitability.
- Enforce the principle of least privilege for user roles to limit the ability of authenticated users to inject malicious content.
- Conduct thorough code reviews and security testing of the affected module to identify and remediate similar vulnerabilities.
- Monitor logs for suspicious POST requests to the product-creation endpoint and unusual user activity.
- Educate users and administrators about the risks of XSS and encourage cautious handling of product data inputs.
- Coordinate with the vendor for official patches or updates and apply them promptly once available.
- Consider deploying Web Application Firewalls (WAFs) with rules targeting XSS payloads as a temporary protective measure.
Description
Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standard POST form. Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is stored and subsequently rendered unsanitized in downstream views, leading to JavaScript execution in other users' browsers when they access the affected product pages. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially enabling session hijacking, privilege escalation within the application, data exfiltration, or administrative account takeover. The application also lacks a restrictive Content Security Policy (CSP), increasing exploitability.