Alo Suite CVE-2026-108056

The attacker must hold authenticated, low-privileged access (PR:L) to the Alo Suite delivery note / company-creation functionality and be able to submit the NombrePF field via /Empresas/Create, where input is insufficiently sanitized and encoded. The payload only executes when another user subsequently views the affected delivery note or company record (UI:P - passive victim interaction is required). Limiting factors: valid credentials are required (not unauthenticated), a second victim user must open the stored record for impact to occur, and impact is scoped to the victim's browser session rather than the host system.

This is a moderate-severity stored XSS (CWE-79) with a vendor/NVD CVSS 4.0 score of 5.1, and the signals are internally consistent rather than conflicting. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows network reach and low attack complexity, but exploitation is gated by two meaningful factors: the attacker needs low-level authenticated access (PR:L) to reach the injection point, and a victim user must view the affected record for the payload to fire (UI:P / passive user interaction). Impact is confined to the subsequent system (the victim's browser session) with low confidentiality and integrity effect (SC:L/SI:L) and no availability or direct impact to the primary system (VC/VI/VA:N). There is no CISA KEV listing, no EPSS score provided, and no public exploit or PoC referenced in the input, so there is no evidence of active exploitation - no public exploit identified at time of analysis. The vuln.today decision label is this_month, indicating routine scheduled remediation rather than emergency urgency. Net: a genuine but not high-priority issue - real because stored XSS in a multi-user business application can hijack other users' sessions, but bounded by the authentication requirement, the need for victim viewing, and an apparently niche product footprint. Note that the single reference is an INCIBE advisory landing page, not a detailed vendor advisory, so patch and fixed-version details are not confirmed in the provided data.

A low-privileged authenticated user of Alo Suite creates or edits a company record via /Empresas/Create and places a JavaScript payload in the NombrePF field, which is stored without adequate sanitization or encoding. When another user - potentially a higher-privileged operator - later opens the affected delivery note or company record, the script executes in their browser session, allowing the attacker to alter displayed content or perform actions as the victim. No public exploit code is identified at time of analysis, so this scenario is derived from the vulnerability class and the supplied CVSS vector.