CVE-2026-108051
Received Received - Intake

Stored XSS in Alosuite Delivery Note Functionality

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-108051
EUVD
EUVD-2026-115800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AM System ALO Suite 25_09_15.03_35

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Alosuite affecting the delivery note functionality. It occurs due to insufficient sanitization and encoding of fields, allowing JavaScript to be stored and executed in other users' browsers when they view affected records. Exploitation requires authenticated access to the vulnerable functionality.

Detection Guidance

To detect this stored XSS vulnerability in Alosuite, inspect the delivery note functionality in the '/Articulos/Create' endpoint. Check if user-supplied input in the 'Nombre' field is reflected without proper sanitization or encoding in the application's output. Manually review stored records for suspicious JavaScript payloads in the affected fields.

Impact Analysis

An attacker could alter displayed content or perform actions within the victim's session. This could lead to unauthorized data access, session hijacking, or defacement of the application. The impact is limited to users who view the affected delivery notes.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution in user browsers. Stored XSS may allow attackers to manipulate displayed content or session actions, risking data integrity and confidentiality. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. Exploitation could lead to unauthorized access or data breaches, violating these standards.

Mitigation Strategies

Apply input validation and output encoding to the 'Nombre' field in the '/Articulos/Create' endpoint. Ensure all user-supplied data is sanitized before storage and properly escaped when rendered in the browser. Update to the latest patched version of Alosuite if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...