This vulnerability is a stored XSS in StockAgile's REST endpoint '/inventory/configuration/serial-number-types'. The server-side input fields like 'code' and 'name' do not properly neutralize malicious JavaScript input, which is then rendered in the web panel accessible to authenticated users. An attacker with valid credentials can inject and persist malicious scripts, leading to arbitrary JavaScript execution in the context of other users viewing the panel.

Exploitation allows a remote attacker with authentication to execute arbitrary JavaScript code in the context of other authenticated users. This can lead to session hijacking, unauthorized actions, or data theft within the StockAgile management panel. The vulnerability does not allow unauthenticated remote code execution and requires user interaction (UI:P).

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoint to trusted users only and consider input validation or web application firewall rules to detect and block malicious input.