CVE-2026-61804

    Dashboard / Vulnerabilities / CVE-2026-61804

    CVE-2026-61804

    Published: 30 Oct 2026Last Modified: 8 Nov 2026

    Summary: myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

    Details: myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.

    References: https://github.com/myTinyWMS/myTinyWMS/tree/v1.6.4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61804.json, https://github.com/myTinyWMS/myTinyWMS/security/advisories/GHSA-gw9m-vphv-gxm5, https://nvd.nist.gov/vuln/detail/CVE-2026-61804, https://github.com/myTinyWMS/myTinyWMS/commit/a01af6bb0e8f4013125c47c795a4736e7cbac7ec

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -a01af6bb0e8f4013125c47c795a4736e7cbac7ec

    Affected versions

    v1.6.3
    v1.6.2
    v1.6.1
    v1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61804 | CVE-DB