Alo Suite EUVD-2026-115804

Exploitation requires an authenticated account with access to the property-creation functionality (/Inmuebles/Create) so the attacker can store a payload in the 'Nombre' field; this is a second-order/stored XSS, so it also requires a separate victim user to subsequently view the affected delivery note or property record (passive user interaction, UI:P). Limiting factors: the attacker must already hold valid low-privilege credentials (PR:L, not unauthenticated), the payload only fires when a victim opens the poisoned record, and impact is confined to the victim's browser session context rather than the server application. This is a multi-user/tenant risk - in a single-user or self-review-only deployment the cross-user execution condition is not met.

This is a medium-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) that is a routine, scheduled-remediation item rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows network reachability with low attack complexity but requires authenticated access (PR:L) and passive victim interaction (UI:P), and limits impact to the subsequent system (the victim's browser session) with no impact on the vulnerable application's own confidentiality, integrity, or availability (VC/VI/VA:N). The vuln.today decision label is 'this_month', consistent with a bounded, non-emergency fix window. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination - authentication requirement, dependence on a victim viewing the record, and absence of any exploitation or probability signal - indicates a real but modest defect: genuinely exploitable in a multi-user tenant where a low-privileged user can poison records other users will open, but not a mass-exploitation or internet-worm candidate. Key missing data: no EPSS, no KEV, no fixed version, and a wildcard CPE that does not pin affected versions.

A low-privileged authenticated user of Alo Suite submits the property-creation form at /Inmuebles/Create and stores a malicious JavaScript payload in the 'Nombre' field. When another user - typically a higher-privileged operator reviewing delivery notes or property records - opens the affected record, the script executes in their browser session and can alter displayed content or perform actions as that victim. No public exploit code or PoC reference is included in the available sources.