Description
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:

CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;
Published: 2026-11-03
Score: 5.1 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

The manufacturer has indicated that the vulnerabilities have been fixed in version 26_04_15.03_10 of ALO Suite, released in April 2026. It is recommended that you use the patched version.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 12:45:00 +0000

Type Values Removed Values Added
Description A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;
Title Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
First Time appeared Am System
Am System alo Suite
Weaknesses CWE-79
CPEs cpe:2.3:a:am_system:alo_suite:25_09_15.03_35:*:*:*:*:*:*:*
Vendors & Products Am System
Am System alo Suite
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Am System Alo Suite
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-11-03T12:26:43.494Z

Reserved: 2026-10-09T10:17:30.064Z

Link: CVE-2026-108058

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')