Alo Suite EUVD-2026-115800

The attacker must hold an authenticated account with access to the article/delivery-note creation functionality (PR:L) and must inject the payload into the 'Nombre' parameter of the /Articulos/Create endpoint, where it is stored due to insufficient input sanitization and output encoding. Execution additionally requires a second user to view the affected record (UI:P), so the payload is passive until a victim loads it - it cannot be triggered unauthenticated or without victim interaction. These two limiting factors (valid credentials plus required victim interaction) substantially reduce the realistic attack surface compared with the network attack vector alone, and impact is confined to the victim's browser session rather than the server.

This is a stored XSS flaw (CWE-79) in AM System's Alo Suite, reported by INCIBE with a CVSS 4.0 base score of 5.1 (medium). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows network reach and low attack complexity, but two factors meaningfully constrain real-world risk: PR:L means the attacker must already hold a valid authenticated account, and UI:P means a victim user must actively view the poisoned record for the payload to fire. Impact is scoped to the subsequent (victim) system with only low confidentiality and integrity effect and no availability or direct vulnerable-system impact, consistent with session-context script execution rather than server compromise. No EPSS score, CISA KEV listing, or POC/exploit reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the picture of an authenticated, interaction-dependent, medium-severity issue - a genuine issue to remediate on a routine cycle rather than an emergency. Net: this is a legitimate but not high-priority vulnerability; the authentication requirement and required victim interaction make opportunistic mass exploitation unlikely.

An authenticated user with access to the article/delivery-note creation form submits a crafted value in the 'Nombre' field of /Articulos/Create containing JavaScript, which is stored without sufficient sanitization or encoding. When another user (e.g. an operator or reviewer) later opens the affected record, the script executes in their browser session, allowing the attacker to alter displayed content or perform actions in the victim's authenticated context. No public exploit code is identified in the provided sources.