Alo Suite EUVD-2026-115806

Exploitation requires an authenticated account with access to the delivery note / PDF template editing functionality (/PlantillasPdf/Edit) and the ability to write to the vulnerable 'Nombre' field (PR:L). It is not self-contained: a second, separate user must subsequently view the affected record for the stored payload to execute (UI:P), so the attacker cannot trigger impact alone. Impact is limited to the victim's browser session (SC:L/SI:L) and does not compromise the application's own data or availability. The main limiting factors are the mandatory authentication and the dependency on another user viewing the poisoned delivery note.

This is a stored XSS (CWE-79) in Alo Suite's delivery note / PDF template functionality (/PlantillasPdf/Edit), scored CVSS 4.0 5.1 (medium). The CVSS vector signals network reach (AV:N), low complexity (AC:L), but critically requires privileges (PR:L - an authenticated account) and passive victim interaction (UI:P - a second user must view the poisoned record). Impact is confined to the subsequent system (SC:L/SI:L, i.e. the victim's browser session) with no impact on the vulnerable application's own confidentiality, integrity, or availability (VC:N/VI:N/VA:N). The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a medium-severity authenticated stored XSS rather than an urgent threat. There is no CISA KEV listing, no EPSS score supplied, and no POC/exploit reference in the input, so there is no evidence of active exploitation or available exploit code. Net assessment: a genuine but second-tier issue - the authentication requirement and the need for another user to view the record substantially limit real-world risk, placing it below internet-facing unauthenticated flaws. EPSS and KEV data are both absent from the input, so exploitation-probability signals cannot be cross-referenced; prioritize per the 'this_month' label.

An attacker with a valid, low-privileged Alo Suite account edits a delivery note / PDF template (e.g. the 'Nombre' field in /PlantillasPdf/Edit) and stores a JavaScript payload where input is not sanitized or encoded. When another user - such as an administrator or colleague - later views the affected record, the script executes in their browser session, letting the attacker alter displayed content or act within the victim's session context. No public exploit is identified at time of analysis.