Alo Suite EUVD-2026-115808

Exploitation requires (1) an authenticated account with access to the delivery-note functionality, specifically the ability to create/edit records via the /Terceros/Create endpoint and write to the 'Observaciones' field (PR:L - authenticated per the CVSS vector), and (2) a second victim user subsequently viewing the affected record in their browser for the stored payload to execute (UI:P - passive user interaction). These two factors materially limit exploitation: it is not remote-unauthenticated, and it cannot self-trigger without a victim opening the poisoned delivery-note record. The trigger mechanism beyond 'insufficient sanitization and encoding' of the Observaciones field is not further detailed in the available sources.

This is a moderate-severity stored XSS (CWE-79) in AM System's Alo Suite, scoring CVSS 5.1 via the vendor-supplied 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The signals are internally consistent and point to a low-to-moderate real-world priority rather than a critical emergency: the network attack vector and low complexity are offset by PR:L (the attacker must already hold authenticated access to the delivery-note/Terceros functionality) and UI:P (a victim must view the poisoned record for the payload to fire). Impact is confined to the subsequent-system confidentiality and integrity sub-scores (SC:L/SI:L) - i.e. the victim's browser session context - with no impact on the primary vulnerable system's C/I/A. No EPSS score, CISA KEV listing, or SSVC automatable/technical-impact data was supplied, so exploitation-probability signals are absent rather than low. The sole vendor priority signal is the vuln.today 'this_month' decision label, which argues for scheduled remediation, not drop-everything urgency. There is no public exploit identified at time of analysis. Net: a genuine but bounded authenticated stored-XSS issue, appropriately mid-tier, not a high-CVSS-but-illusory finding nor a widespread-exploitation threat on current data.

An authenticated user with access to the delivery-note workflow submits a record via /Terceros/Create, injecting a JavaScript payload into the 'Observaciones' field, which is stored without adequate sanitization/encoding. When another user (e.g. an administrator or colleague) later opens that record, the script executes in their browser under their session, allowing content manipulation and actions in the victim's context. No public exploit code is identified at time of analysis, and successful exploitation depends on a second user viewing the affected record (UI:P).