Alo Suite
Monthly
Alo Suite's user-invitation workflow can assign administrative privileges to a newly invited account because the '/Requests/userInvitation' endpoint does not enforce privilege-assignment checks server-side. An attacker who can intercept and alter invitation parameters may escalate privileges; the supplied CVSS vector requires low privileges (PR:L), while the description says unauthenticated, so the precise prerequisite remains unresolved and should be verified against the INCIBE advisory. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre' field of the /Trabajadores/Create (worker creation) workflow, which is later rendered unsanitized in the delivery-note functionality and executes in the browser of any other user who opens the affected record. Exploitation requires a valid low-privileged account plus victim interaction - a second user actually viewing the record - after which the script can alter displayed content and act within the victim's session. Rated medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this aligns with a 'this_month' remediation priority rather than an emergency, and no public exploit has been identified at time of analysis.
Stored cross-site scripting in AM System Alo Suite's delivery-note functionality allows an authenticated user to persist JavaScript through the "Observaciones" field on the /Terceros/Create endpoint, which then executes in another user's browser when that record is viewed. The vendor-supplied CVSS 4.0 score is 5.1, with exploitation requiring a valid account that can create or edit delivery notes and a victim who subsequently opens the affected record; the payload can alter displayed content and perform actions in the victim's session. No public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in Alo Suite (AM System) lets an authenticated user with access to the mail-template editor inject JavaScript through the 'Nombre' field at /PlantillasMail/Edit; the payload is persisted and then executes in the browser of another user who views the affected delivery-note records, allowing the attacker to alter displayed content and act within the victim's session. The vendor rates it CVSS 4.0 base 5.1, and the assessed impact is confined to the victim's session (S:C/C:L/I:L, no server-side confidentiality, integrity or availability impact). No public exploit was identified at time of analysis and there is no KEV listing; priority is routine (this_month).
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre' field of the delivery note / PDF template editor at /PlantillasPdf/Edit/1273129, which then runs in the browser of any other user who opens the affected record. The vendor-agnostic CPE entry (cpe:2.3:a:am_system:alo_suite:*:*:*:*:*:*:*:*) gives no version boundary, so all deployments of the affected module should be treated as potentially exposed until the vendor confirms a fixed release. Impact is confined to the victim's browser session in the application context (VC:N/VI:N/VA:N, SC:L/SI:L) and requires a second user to view the poisoned record; INCIBE rates it CVSS 4.0 5.1 (medium) and no public exploit code has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in AM System Alo Suite lets an authenticated, low-privileged user persist JavaScript through the NombrePF field submitted to /Empresas/Create, which then executes in the browser of any user who later opens the affected company or delivery note record. Because the payload runs inside the victim's session, it can alter displayed content and perform actions as that user, although the vendor/NVD CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P, subsequent confidentiality and integrity Low) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) both keep the rating moderate: valid credentials and a second user viewing the stored record are prerequisites. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in Alo Suite lets an authenticated user with access to /Inmuebles/Create persist JavaScript in the 'Nombre' field, which executes in another user's browser when that person views the affected delivery note or property record. The CVSS 4.0 base score is 5.1 (medium), and the issue is a scheduled, this-month remediation item; no public exploit was identified at time of analysis, and exploitation requires valid low-privilege credentials plus a victim viewing the poisoned record.
Stored cross-site scripting (CWE-79) in AM System's Alo Suite lets an authenticated low-privilege user plant JavaScript in the 'Nombre' field reached through the /Familias/Edit/{id} endpoint of the delivery-note functionality; the script is persisted without adequate sanitization and executes in the browser of any other user who later opens the poisoned record. Because the payload runs in the victim's authenticated session context, it can alter displayed content and perform actions as that user, although impact is confined to the victim's browser (scope change limited to low confidentiality and integrity). Exploitation is not remote-unauthenticated: it requires a valid low-privilege account to write the field plus a second user who views the record; no public exploit code and no CISA KEV active-exploitation listing were identified at the time of analysis, and the vendor priority signal rates it as an issue to handle this month.
Stored cross-site scripting in AM System's Alo Suite lets authenticated users with access to the current-accounts creation function persist JavaScript in the 'Nombre' field of delivery-note records, where it executes in another user's browser when that record is viewed. The issue is medium severity (CVSS 5.1, CVSS 4.0; CWE-79) and requires both a valid low-privileged account and victim interaction, so the payload does not fire automatically or affect unauthenticated users. Impact is limited to the victim's browser session (SC:L/SI:L), with no stated effect on the server's own confidentiality, integrity, or availability; no public exploit was identified at time of analysis.
Stored cross-site scripting in AM Systems Alo Suite lets an authenticated user with write access to the 'Codigo' field of the '/CategoriasFicheros/Edit/{id}' endpoint persist JavaScript that later executes in other users' browsers when they open the affected delivery-note record. The injected script runs in the victim's session context, allowing the attacker to alter displayed content and perform actions as that user; there is no direct server-side confidentiality, integrity or availability impact. Rated CVSS 4.0 base 5.1 (assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), it requires a valid account with access to this feature plus victim interaction, and no public exploit code or active exploitation has been identified at time of analysis; priority is this_month.
Stored cross-site scripting in Alo Suite lets authenticated users with article or delivery-note creation rights inject JavaScript through the Nombre parameter of /Articulos/Create, and the script executes in the browser of another user who later views the affected record. The reported CVSS 4.0 base score is 5.1 (medium), with the independent assessment scoring it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Impact is limited to the victim's browser session, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Alo Suite's delivery note editor allows a user who can edit delivery notes to persist JavaScript through the ReferenceOtherParty field on the /Documents/DeliveryNotes/Edit/{id} endpoint, which then executes in the browser of any other user who opens the affected record. The vendor rates it CVSS 4.0 base 5.1 and our assessment scores it CVSS 3.1 6.1 with scope change, reflecting that impact is confined to the victim's browser session (content modification and actions performed as that user) rather than the server. Exploitation requires an authenticated low-privilege account plus a second user viewing the tampered note; no public exploit code or CISA KEV entry was identified at time of analysis, and the priority label is 'this_month' rather than an emergency.
Clickjacking in the AM Systems Alo Suite web application lets an attacker embed the login interface inside an attacker-controlled page and trick a victim into clicking disguised controls, so the practical impact is tampering with user interactions rather than disclosure of data. Deployments are exposed when the login page is served without X-Frame-Options or a Content-Security-Policy frame-ancestors directive; the CPE entry carries a wildcard version, so no specific release range is pinned in the available data. Severity is moderate (CVSS 4.0 base 5.1, integrity-only impact rated Low, active user interaction required), the issue is not listed in CISA KEV, and no public exploit code was identified at time of analysis.
Alo Suite's password recovery endpoint '/Account/resetPwd' lacks rate and frequency limits, so remote attackers can repeatedly trigger unlimited reset emails to a single account, flooding the user's inbox and consuming application and mail infrastructure resources (CWE-770). The flaw affects Alo Suite installations exposing the password-recovery feature (CPE cpe:2.3:a:am_system:alo_suite), requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and is assessed as a moderate-severity availability issue with limited impact (CVSS:3.1 A:L; no confidentiality or integrity effect). The trigger is straightforward endpoint abuse per the available sources; no public exploit code or active exploitation is confirmed, though the vendor advisory from INCIBE is available.
Unauthenticated information disclosure in AM Systems Alo Suite allows remote attackers to read records belonging to other companies or users by substituting the object identifier in requests to the '/Companies/Edit/{id}' endpoint. The underlying flaw (CWE-639, IDOR) is a missing authorization check on the supplied identifier, so confidentiality impact is limited but the exposure is tenant-crossing: any reachable deployment of the affected product can be queried for data the requester should not see, and its practical value depends on identifiers being enumerable or predictable. Reported severity is moderate (6.9 on CVSS v4.0; assessed 5.3-equivalent vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the issue is not in CISA KEV and no public exploit identified at time of analysis, and the vuln.today decision label places remediation in the 'this month' window rather than an emergency response.
Alo Suite's user-invitation workflow can assign administrative privileges to a newly invited account because the '/Requests/userInvitation' endpoint does not enforce privilege-assignment checks server-side. An attacker who can intercept and alter invitation parameters may escalate privileges; the supplied CVSS vector requires low privileges (PR:L), while the description says unauthenticated, so the precise prerequisite remains unresolved and should be verified against the INCIBE advisory. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre' field of the /Trabajadores/Create (worker creation) workflow, which is later rendered unsanitized in the delivery-note functionality and executes in the browser of any other user who opens the affected record. Exploitation requires a valid low-privileged account plus victim interaction - a second user actually viewing the record - after which the script can alter displayed content and act within the victim's session. Rated medium severity (CVSS 4.0 base 5.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), this aligns with a 'this_month' remediation priority rather than an emergency, and no public exploit has been identified at time of analysis.
Stored cross-site scripting in AM System Alo Suite's delivery-note functionality allows an authenticated user to persist JavaScript through the "Observaciones" field on the /Terceros/Create endpoint, which then executes in another user's browser when that record is viewed. The vendor-supplied CVSS 4.0 score is 5.1, with exploitation requiring a valid account that can create or edit delivery notes and a victim who subsequently opens the affected record; the payload can alter displayed content and perform actions in the victim's session. No public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in Alo Suite (AM System) lets an authenticated user with access to the mail-template editor inject JavaScript through the 'Nombre' field at /PlantillasMail/Edit; the payload is persisted and then executes in the browser of another user who views the affected delivery-note records, allowing the attacker to alter displayed content and act within the victim's session. The vendor rates it CVSS 4.0 base 5.1, and the assessed impact is confined to the victim's session (S:C/C:L/I:L, no server-side confidentiality, integrity or availability impact). No public exploit was identified at time of analysis and there is no KEV listing; priority is routine (this_month).
Stored cross-site scripting in AM System's Alo Suite lets an authenticated user persist JavaScript through the 'Nombre' field of the delivery note / PDF template editor at /PlantillasPdf/Edit/1273129, which then runs in the browser of any other user who opens the affected record. The vendor-agnostic CPE entry (cpe:2.3:a:am_system:alo_suite:*:*:*:*:*:*:*:*) gives no version boundary, so all deployments of the affected module should be treated as potentially exposed until the vendor confirms a fixed release. Impact is confined to the victim's browser session in the application context (VC:N/VI:N/VA:N, SC:L/SI:L) and requires a second user to view the poisoned record; INCIBE rates it CVSS 4.0 5.1 (medium) and no public exploit code has been identified at time of analysis.
Stored cross-site scripting (CWE-79) in AM System Alo Suite lets an authenticated, low-privileged user persist JavaScript through the NombrePF field submitted to /Empresas/Create, which then executes in the browser of any user who later opens the affected company or delivery note record. Because the payload runs inside the victim's session, it can alter displayed content and perform actions as that user, although the vendor/NVD CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P, subsequent confidentiality and integrity Low) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) both keep the rating moderate: valid credentials and a second user viewing the stored record are prerequisites. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this is a this-month priority rather than an emergency.
Stored cross-site scripting in Alo Suite lets an authenticated user with access to /Inmuebles/Create persist JavaScript in the 'Nombre' field, which executes in another user's browser when that person views the affected delivery note or property record. The CVSS 4.0 base score is 5.1 (medium), and the issue is a scheduled, this-month remediation item; no public exploit was identified at time of analysis, and exploitation requires valid low-privilege credentials plus a victim viewing the poisoned record.
Stored cross-site scripting (CWE-79) in AM System's Alo Suite lets an authenticated low-privilege user plant JavaScript in the 'Nombre' field reached through the /Familias/Edit/{id} endpoint of the delivery-note functionality; the script is persisted without adequate sanitization and executes in the browser of any other user who later opens the poisoned record. Because the payload runs in the victim's authenticated session context, it can alter displayed content and perform actions as that user, although impact is confined to the victim's browser (scope change limited to low confidentiality and integrity). Exploitation is not remote-unauthenticated: it requires a valid low-privilege account to write the field plus a second user who views the record; no public exploit code and no CISA KEV active-exploitation listing were identified at the time of analysis, and the vendor priority signal rates it as an issue to handle this month.
Stored cross-site scripting in AM System's Alo Suite lets authenticated users with access to the current-accounts creation function persist JavaScript in the 'Nombre' field of delivery-note records, where it executes in another user's browser when that record is viewed. The issue is medium severity (CVSS 5.1, CVSS 4.0; CWE-79) and requires both a valid low-privileged account and victim interaction, so the payload does not fire automatically or affect unauthenticated users. Impact is limited to the victim's browser session (SC:L/SI:L), with no stated effect on the server's own confidentiality, integrity, or availability; no public exploit was identified at time of analysis.
Stored cross-site scripting in AM Systems Alo Suite lets an authenticated user with write access to the 'Codigo' field of the '/CategoriasFicheros/Edit/{id}' endpoint persist JavaScript that later executes in other users' browsers when they open the affected delivery-note record. The injected script runs in the victim's session context, allowing the attacker to alter displayed content and perform actions as that user; there is no direct server-side confidentiality, integrity or availability impact. Rated CVSS 4.0 base 5.1 (assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), it requires a valid account with access to this feature plus victim interaction, and no public exploit code or active exploitation has been identified at time of analysis; priority is this_month.
Stored cross-site scripting in Alo Suite lets authenticated users with article or delivery-note creation rights inject JavaScript through the Nombre parameter of /Articulos/Create, and the script executes in the browser of another user who later views the affected record. The reported CVSS 4.0 base score is 5.1 (medium), with the independent assessment scoring it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Impact is limited to the victim's browser session, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Alo Suite's delivery note editor allows a user who can edit delivery notes to persist JavaScript through the ReferenceOtherParty field on the /Documents/DeliveryNotes/Edit/{id} endpoint, which then executes in the browser of any other user who opens the affected record. The vendor rates it CVSS 4.0 base 5.1 and our assessment scores it CVSS 3.1 6.1 with scope change, reflecting that impact is confined to the victim's browser session (content modification and actions performed as that user) rather than the server. Exploitation requires an authenticated low-privilege account plus a second user viewing the tampered note; no public exploit code or CISA KEV entry was identified at time of analysis, and the priority label is 'this_month' rather than an emergency.
Clickjacking in the AM Systems Alo Suite web application lets an attacker embed the login interface inside an attacker-controlled page and trick a victim into clicking disguised controls, so the practical impact is tampering with user interactions rather than disclosure of data. Deployments are exposed when the login page is served without X-Frame-Options or a Content-Security-Policy frame-ancestors directive; the CPE entry carries a wildcard version, so no specific release range is pinned in the available data. Severity is moderate (CVSS 4.0 base 5.1, integrity-only impact rated Low, active user interaction required), the issue is not listed in CISA KEV, and no public exploit code was identified at time of analysis.
Alo Suite's password recovery endpoint '/Account/resetPwd' lacks rate and frequency limits, so remote attackers can repeatedly trigger unlimited reset emails to a single account, flooding the user's inbox and consuming application and mail infrastructure resources (CWE-770). The flaw affects Alo Suite installations exposing the password-recovery feature (CPE cpe:2.3:a:am_system:alo_suite), requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and is assessed as a moderate-severity availability issue with limited impact (CVSS:3.1 A:L; no confidentiality or integrity effect). The trigger is straightforward endpoint abuse per the available sources; no public exploit code or active exploitation is confirmed, though the vendor advisory from INCIBE is available.
Unauthenticated information disclosure in AM Systems Alo Suite allows remote attackers to read records belonging to other companies or users by substituting the object identifier in requests to the '/Companies/Edit/{id}' endpoint. The underlying flaw (CWE-639, IDOR) is a missing authorization check on the supplied identifier, so confidentiality impact is limited but the exposure is tenant-crossing: any reachable deployment of the affected product can be queried for data the requester should not see, and its practical value depends on identifiers being enumerable or predictable. Reported severity is moderate (6.9 on CVSS v4.0; assessed 5.3-equivalent vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the issue is not in CISA KEV and no public exploit identified at time of analysis, and the vuln.today decision label places remediation in the 'this month' window rather than an emergency response.