CVE-2026-108054: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
An attacker needs authenticated access to the affected functionality and must be able to submit content to the specified field. Other users are at risk when they view affected records, because the stored JavaScript executes in their browser under their session context.
Which input location is identified as affected?
The affected field is Nombre on the /Familias/Edit/{id} endpoint.
What can the injected code do in a victim's session?
The stored code can alter displayed content and perform actions in the context of the user who views the affected record.