CVE-2026-108057: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk when it is triggered?
Exploitation requires authenticated access to the affected delivery note functionality. Other users are exposed when they view a record containing the stored JavaScript, which then runs in their browser in the context of their session.
Which input and endpoint are identified as affected?
The affected field is Nombre at /PlantillasPdf/Edit/1273129. The issue is associated with delivery note functionality.
What can the injected code do in a victim's browser?
The stored JavaScript can alter displayed content and perform actions within the context of the victim's session.