Alo Suite EUVD-2026-115799

Requires an authenticated account with privileges to edit delivery notes so the attacker can write a payload into the ReferenceOtherParty field at /Documents/DeliveryNotes/Edit/{id} (PR:L). Exploitation further depends on a second user viewing the affected delivery note record for the stored script to fire (UI:P / passive interaction). Limiting factors: the attacker must already hold valid low-privilege access to the delivery note functionality, a separate victim must open the tampered record, and impact is confined to the victim's browser/session context rather than the server itself.

This is a medium-severity stored XSS (vendor CVSS 4.0 base score 5.1) whose real-world risk is moderate and bounded, not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) tells a coherent story: network-reachable and low-complexity, but it requires existing low-level authenticated access (PR:L) to write the payload and passive interaction from a victim (UI:P) who must view the affected delivery note. Impact is confined to the subsequent (victim browser) system - SC:L/SI:L - with no direct confidentiality, integrity, or availability impact to the vulnerable application itself (VC/VI/VA:N), consistent with session-context script execution rather than server compromise. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vulnerability is NOT listed in CISA KEV and the single INCIBE reference is an advisory, not exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - a routine-but-timely remediation signal rather than act_now/emergency. Net: a legitimate issue to patch on a normal cycle, de-prioritized relative to unauthenticated or server-impacting flaws by the authentication and user-interaction prerequisites, but not a false alarm given stored XSS can be used for session-context actions against other users.

An authenticated low-privilege user with access to delivery note editing stores a JavaScript payload in the ReferenceOtherParty field of a delivery note at /Documents/DeliveryNotes/Edit/{id}. When another user - such as a colleague or administrator - later opens that delivery note, the script executes in their browser session, allowing the attacker to alter displayed content or perform actions as the victim. No public exploit code is identified; the only source is the INCIBE advisory.