CVE-2026-61804

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` management store the `name` parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including `article/index.blade.php` and `category/index.blade.php`. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.

• CWE-79

• https://github.com/myTinyWMS/myTinyWMS/commit/a01af6bb0e8f4013125c47c795a4736e7cbac7ec
• https://github.com/myTinyWMS/myTinyWMS/security/advisories/GHSA-gw9m-vphv-gxm5
• https://github.com/myTinyWMS/myTinyWMS/tree/v1.6.4

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61795Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61801The `github.com/moby/sys/user` package provides Go utilities…5.5
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61803Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61805Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.1
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-61811Wazuh is an open-source security platform providing unified …6.5