This vulnerability is a stored XSS in StockAgile's server-side REST endpoint '/inventory/configuration/variants'. The issue arises because input parameters such as 'code' and 'name' are not properly sanitized or validated, enabling injection and persistence of malicious JavaScript code. When this data is rendered in the web management panel, authenticated users may have arbitrary scripts executed in their browsers. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, and requiring low privileges and user interaction.

An attacker with prior authentication can inject malicious JavaScript code that will be stored and executed in the context of other authenticated users viewing the affected panel. This can lead to session hijacking, unauthorized actions, or information disclosure within the scope of the authenticated user's privileges. However, the impact is limited by the need for attacker authentication and user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and consider implementing input validation or output encoding at the application level if possible.