CVE-2026-61804

myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, Product (Artikel) and Category management store the name parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including article/index.blade.php and category/index.blade.php. An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.