myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, "Product (Artikel)" and "Category" management store the "name" parameter without adequate backend sanitization and render raw database strings through unescaped Blade output in dynamic table cells, including "article/index.blade.php" and "category/index.blade.php". An authenticated attacker can save malicious input through product creation or category forms. When another user, including a worker or administrator, opens the corresponding product sheet, category listing or dashboard, the stored JavaScript executes in that user's browser context. This can enable cross-user script execution, session theft and administrative takeover. This issue is fixed in version 1.6.4.