Alo Suite EUVD-2026-115802

Exploitation requires an authenticated account with access to the current-accounts creation function (/CuentasCorrientes/Create), where the attacker stores JavaScript in the 'Nombre' field (PR:L). The payload is persistent but inert until a second user opens the affected record, so successful exploitation also requires victim user interaction (UI:P) - it does not fire automatically or against unauthenticated users. These two factors - the need for valid credentials and a victim actually viewing the poisoned record - are the principal limits on real-world exploitation. Impact is bounded to the victim's browser session (SC:L/SI:L); there is no stated impact to the server's own confidentiality, integrity, or availability.

This is a medium-severity stored XSS (CWE-79) in AM System's Alo Suite, assessed at CVSS 5.1 (CVSS 4.0). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P indicates a network-reachable but authenticated attacker (PR:L) whose payload only fires when a victim actively views the affected record (UI:P). Impact is confined to the subsequent system (SC:L/SI:L) with no direct confidentiality, integrity, or availability loss to the vulnerable system itself (VC:N/VI:N/VA:N) - consistent with XSS executing in another user's browser session rather than compromising the server. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the moderate score. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent - there is no conflict between the CVSS network vector and the description, since the attacker reaches the web app over the network but must first authenticate. The realistic priority is moderate: it requires valid credentials plus a victim viewing the poisoned record, so this is a genuine but second-tier issue rather than a drop-everything emergency.

An authenticated Alo Suite user with access to the current-accounts function submits a crafted 'Nombre' value containing JavaScript at /CuentasCorrientes/Create. When another user - such as an administrator or colleague - later opens the stored delivery-note/current-account record, the script executes in their browser under their session, letting the attacker alter displayed content or act as that victim. No public exploit code was identified at time of analysis, and exploitation depends on the victim opening the affected record.