Alo Suite CVE-2026-108052

Exploitation requires authenticated access to the Alo Suite delivery-note functionality, specifically write access to the 'Codigo' field of the '/CategoriasFicheros/Edit/{id}' endpoint, where insufficient sanitization and output encoding allow JavaScript to be stored. Execution is not immediate: a second user must subsequently view the affected record for the stored script to run in their browser (UI:P / victim interaction required). Limiting factors are therefore the need for a valid authenticated account with access to this feature and the dependency on a victim opening the poisoned record; impact is bounded to the victim's session context, with no direct server-side confidentiality, integrity, or availability impact.

This is a moderate-severity stored XSS (CWE-79) carrying a CVSS 4.0 base score of 5.1. The vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows that although the flaw is reachable over the network with low complexity, it requires authenticated access (PR:L) to the delivery-note / '/CategoriasFicheros/Edit/{id}' functionality and depends on a victim subsequently viewing the poisoned record (UI:P). Impact is confined to subsequent-system integrity and confidentiality at low (SC:L/SI:L) with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) - consistent with session-context script execution rather than server compromise. No EPSS score, KEV listing, or POC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', which aligns with a patch-on-normal-cycle priority rather than an emergency. Net assessment: a genuine but not urgent issue - the authentication requirement and need for victim interaction meaningfully limit real-world risk, and the absence of exploitation signals (EPSS/KEV/POC) supports treating this as routine remediation rather than a top priority.

An authenticated user with access to the delivery-note functionality stores JavaScript in the 'Codigo' field of '/CategoriasFicheros/Edit/{id}'. When another user (e.g. staff reviewing the record) opens the affected record, the stored script executes in their browser session and can alter displayed content or perform actions as that victim. No public exploit code is identified; the network vector and low complexity make the stored injection itself straightforward for any authenticated actor.