EUVD-2026-115803
GHSA-w4vf-pvj6-73g5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated access
-
DeliveryStore JS payload in Nombre field of /Familias/Edit/{id}
-
ExploitVictim user views affected delivery-note record
-
ExecutionScript executes in victim's session
-
ImpactPerform actions in victim's context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account with low privileges (PR:L) that can write to the 'Nombre' field reached via /Familias/Edit/{id} in Alo Suite's delivery-note functionality, plus a second victim user who subsequently opens the affected record (UI:P) for the stored script to execute. Limiting factors: the attacker must already be authenticated to the application, the payload only triggers when another user views the poisoned record, and impact is bounded to that victim's browser session (SC:L/SI:L) with no server-side code execution or availability impact. This is not remote-unauthenticated; a valid foothold and victim interaction are both mandatory. |
| Impact | This is a stored XSS flaw (CWE-79) in AM System's Alo Suite, carrying a moderate CVSS 4.0 base score of 5.1. The provided vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N shows network reach and low attack complexity, but two factors meaningfully constrain real-world risk: PR:L means the attacker must already hold authenticated access to inject the payload, and UI:P means a second user must actively view the poisoned delivery-note record for the script to fire. Impact is confined to the subsequent system (the victim's browser/session) at low confidentiality and integrity (SC:L/SI:L) with no availability impact - there is no direct code execution on the server. There is no EPSS score, no CISA KEV listing, and no proof-of-concept in the input, so the signals are consistent in pointing to a low-urgency, insider-or-foothold-dependent issue rather than mass exploitation. The vuln.today decision label 'this_month' aligns with that reading: it warrants scheduled patching, not emergency response. No signals conflict here; the main caveat is that all severity data derives from a single INCIBE advisory with no independent corroboration. |
| Exploit ScenarioDerived | An authenticated low-privilege user with access to the delivery-note/Familias editing functionality stores a malicious JavaScript payload in the 'Nombre' field of /Familias/Edit/{id}. When another user - such as an operator or administrator - later opens that record, the script executes in their browser session, letting the attacker alter displayed content or perform actions in the victim's authenticated context. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Stored cross-site scripting (CWE-79) in AM System's Alo Suite lets an authenticated low-privilege user plant JavaScript in the 'Nombre' field reached through the /Familias/Edit/{id} endpoint of the delivery-note functionality; the script is persisted without adequate sanitization and executes in the browser of any other user who later opens the poisoned record. Because the payload runs in the victim's authenticated session context, it can alter displayed content and perform actions as that user, although impact is confined to the victim's browser (scope change limited to low confidentiality and integrity). Exploitation is not remote-unauthenticated: it requires a valid low-privilege account to write the field plus a second user who views the record; no public exploit code and no CISA KEV active-exploitation listing were identified at the time of analysis, and the vendor priority signal rates it as an issue to handle this month.
RemediationAI
No vendor-released patch with an identifiable fixed version is referenced in the available data, so the exact remediated build must be confirmed against the INCIBE-CERT advisory for AM Systems Alo Suite (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite) before relying on an upgrade; treat this as patch status unconfirmed rather than as a permanent absence of a fix. Until a fixed release is validated, apply compensating controls targeted at the affected write path: restrict who can create or edit records that populate the 'Nombre' field through /Familias/Edit/{id} so that only trusted, minimal sets of accounts can write to it (reduces the attacker pool but requires role re-design), and enforce server-side output encoding or HTML sanitization on stored values at render time so that previously stored payloads no longer execute (a sanitization layer can alter legitimate formatting in delivery-note records and must be regression-tested). A Content-Security-Policy that blocks inline and third-party script execution on the affected views adds containment for already-poisoned records, with the trade-off that any legitimate inline scripts in Alo Suite views will break and must be whitelisted. Auditing existing delivery-note and 'Nombre' values for injected markup and removing any found reduces the chance that a previously planted payload fires before the code fix is deployed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic persistent (stored) XSS under CWE-79: user-supplied input written to the 'Nombre' field via the /Familias/Edit/{id} route is stored and later rendered into other users' pages without sufficient output encoding or HTML sanitization, so markup and script survive round-tripping through the application and execute on view. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that the attacker must already hold an authenticated low-privilege account (PR:L), that a victim must interact by opening the affected record (UI:P), and that the consequence lands on the victim's browser rather than the server (scope changed, low confidentiality and integrity, no availability impact). CPE data (cpe:2.3:a:am_system:alo_suite:*:*:*:*:*:*:*:*) marks the whole Alo Suite product line with no version boundary, so the precise vulnerable build range is not established by the available sources and the trigger conditions beyond the described 'Nombre' field are not detailed in the reference. The underlying server-side technology stack and the exact sanitization routine in use are not described in the available sources.
Know when Alo Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Authenticated injection gives PR:L and stored XSS requires a victim to view the record (UI:R); the payload executing in the victim's browser crosses a trust boundary (S:C) with low C/I and no availability impact.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Alo Suite's user-invitation workflow can assign administrative privileges to a newly invited account because the '/Reque
Alo Suite's password recovery endpoint '/Account/resetPwd' lacks rate and frequency limits, so remote attackers can repe
Unauthenticated information disclosure in AM Systems Alo Suite allows remote attackers to read records belonging to othe
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre'
Stored cross-site scripting in AM System Alo Suite's delivery-note functionality allows an authenticated user to persist
Stored cross-site scripting in Alo Suite (AM System) lets an authenticated user with access to the mail-template editor
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre'
Stored cross-site scripting (CWE-79) in AM System Alo Suite lets an authenticated, low-privileged user persist JavaScrip
Stored cross-site scripting in Alo Suite lets an authenticated user with access to /Inmuebles/Create persist JavaScript
Stored cross-site scripting in AM System's Alo Suite lets authenticated users with access to the current-accounts creati
Stored cross-site scripting in AM Systems Alo Suite lets an authenticated user with write access to the 'Codigo' field o
Stored cross-site scripting in Alo Suite lets authenticated users with article or delivery-note creation rights inject J
Exploit-DB