CVE-2025-57204

Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standard POST form. Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is stored and subsequently rendered unsanitized in downstream views, leading to JavaScript execution in other users' browsers when they access the affected product pages. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially enabling session hijacking, privilege escalation within the application, data exfiltration, or administrative account takeover. The application also lacks a restrictive Content Security Policy (CSP), increasing exploitability.

• CWE-79

• https://codecanyon.net/item/stockyultimate-inventory-management-system-with-pos/31445124Product
• https://grumpz.net/cve-2025-57204-stored-xss-in-stocky-pos-with-inventory-management-and-hrm-ui-lib-50Exploit, Third Party Advisory
• https://grumpz.net/cve-2025-57204-stored-xss-in-stocky-pos-with-inventory-management-and-hrm-ui-lib-50Exploit, Third Party Advisory

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57199AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1…8.8
• CVE-2025-5720The Customer Reviews for WooCommerce plugin for WordPress is…6.4
• CVE-2025-57200AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1…6.5
• CVE-2025-57201AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1…8.8
• CVE-2025-57202A stored cross-site scripting (XSS) vulnerability in the Pwd…6.1
• CVE-2025-57203MagicProject AI version 9.1 is affected by a Cross-Site Scri…4.8
• CVE-2025-57205iNiLabs School Express (SMS Express) 6.2 is affected by a St…5.4
• CVE-2025-5721A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2025-57210Incorrect access control in the component ApiPayController.j…7.5
• CVE-2025-57212Incorrect access control in the component ApiOrderService.ja…7.5
• CVE-2025-57213Incorrect access control in the component orderService.query…7.5
• CVE-2025-57215Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to cont…7.5