This vulnerability is a stored XSS in StockAgile's API and management panel. The REST endpoint '/inventory/configuration/payment-methods' improperly neutralizes input in parameters such as 'code' and 'name', allowing malicious JavaScript code to be injected and stored on the server. When displayed on the web panel, the scripts execute in the browsers of authenticated users. The flaw requires the attacker to be authenticated and involves low attack complexity with partial user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no attack or user privileges required beyond authentication, and low impact on confidentiality and integrity.

An authenticated remote attacker can inject and store malicious JavaScript code that executes in the browsers of other authenticated users accessing the management panel. This can lead to unauthorized actions performed in the context of the victim user, potentially compromising user sessions or data accessible to the user. The impact is limited by the requirement for attacker authentication and partial user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoint to trusted users only and consider implementing input validation or output encoding on the server side to mitigate injection of malicious scripts.