This vulnerability is a stored cross-site scripting (CWE-79) issue in the StockAgile product by Novadigits technologies. The flaw exists in the server-side REST endpoint '/inventory/configuration/categories', where input parameters such as 'code' and 'name' are not properly sanitized. This allows an attacker with authentication to inject malicious JavaScript code that is stored and later executed in the context of authenticated users viewing the management panel. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack traceability, low impact on confidentiality and integrity, and no impact on availability.

Exploitation of this vulnerability could allow a remote attacker with valid authentication to execute arbitrary JavaScript code in the context of other authenticated users. This could lead to session hijacking, unauthorized actions within the application, or other malicious activities performed with the privileges of the victim user. There is no indication of impact on availability or direct data compromise beyond what can be achieved via script execution.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the affected endpoint to trusted users only and monitor for suspicious activity. Input validation and output encoding should be implemented on the server side to prevent injection of malicious scripts.