This vulnerability is a stored XSS in StockAgile's API and management panel. The REST endpoint '/inventory/configuration/categories' accepts input parameters such as 'code' and 'name' that are not properly sanitized, allowing injection and persistence of malicious JavaScript code. When authenticated users view the affected pages, the injected scripts execute in their browsers, potentially leading to unauthorized actions or data exposure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack or user interaction required beyond authentication, and low impact on confidentiality and integrity.

An authenticated remote attacker can inject malicious JavaScript code that is stored on the server and executed in the browsers of other authenticated users accessing the management panel. This can lead to unauthorized actions performed in the context of the victim user, potentially compromising user sessions or data accessible to the user. The impact is limited to authenticated users and the scope is confined to the affected web interface.

No official patch or remediation information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint and management panel to trusted users only. Consider implementing input validation and output encoding on the affected parameters to mitigate exploitation.