Alo Suite EUVD-2026-115807

Exploitation requires an authenticated account (PR:L) with access to the mail-template editing functionality at /PlantillasMail/Edit, where the attacker injects a payload into the 'Nombre' field. The stored payload only triggers when a second user views the affected delivery-note records (UI:P / passive interaction), so exploitation depends on a victim opening the poisoned record. Limiting factors: the attacker needs valid credentials and access to the vulnerable feature, impact is confined to the victim's authenticated browser session (no server-side confidentiality/integrity/availability impact), and no unauthenticated or default-configuration path exists.

This is a medium-severity stored XSS (vendor CVSS 4.0 base 5.1) that is a routine-priority item rather than an urgent threat. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the signal picture: no CISA KEV listing, no EPSS score supplied, and no public exploit identified at time of analysis - the only reference is the INCIBE coordinated advisory, not proof-of-concept code. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) is internally consistent with a stored XSS: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and passive victim interaction (UI:P), with impact confined to the subsequent system (the victim's browser session, SC:L/SI:L) and no direct confidentiality/integrity/availability loss on the vulnerable server itself. No EPSS or KEV data was provided, so probabilistic exploitation likelihood cannot be stated; absence of those signals is not evidence of safety but does mean nothing here elevates this above normal patch cadence. Net: a genuine but contained issue - authenticated stored XSS in a niche business-management product - appropriately triaged as scheduled remediation.

An authenticated low-privilege user with access to the mail-template editing feature stores a JavaScript payload in the 'Nombre' field at /PlantillasMail/Edit. When another user (e.g. an operator viewing the associated delivery-note records) opens the affected record, the script executes in their browser session, allowing the attacker to alter displayed content or perform actions as the victim. No public exploit code was identified at time of analysis.