XSS in Ui-Lib Stocky
CVE-2025-57204
Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standard POST form. Due to insufficient input sanitization and output encoding, attackers can inject HTML/JS payloads. The payload is stored and subsequently rendered unsanitized in downstream views, leading to JavaScript execution in other users' browsers when they access the affected product pages. This issue allows an authenticated attacker to execute arbitrary JavaScript in the context of another user, potentially enabling session hijacking, privilege escalation within the application, data exfiltration, or administrative account takeover. The application also lacks a restrictive Content Security Policy (CSP), increasing exploitability.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (15.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Ui-Lib Stocky — versions 5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- codecanyon.net/item/stockyultimate-inventory-management-system-with-pos/31445124 (Product)
- grumpz.net/cve-2025-57204-stored-xss-in-stocky-pos-with-inventory-management-an… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-57204?
- CVE-2025-57204 is a medium-severity vulnerability in Ui-Lib Stocky, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-09-22.
- How severe is CVE-2025-57204?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2025-57204 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.