CVE-2026-108059: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108059: Observaciones in ‘/Terceros/Create’;
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from stored payloads?
An attacker needs authenticated access to the affected delivery-note functionality and the ability to submit the Observaciones field at /Terceros/Create. Other users are exposed when they view records containing the stored payload, because it executes in their browser session.
What can successful exploitation do?
The injected JavaScript can alter content displayed to the victim and perform actions in the context of that victim's authenticated session. The provided information does not identify additional impacts beyond those browser-session actions.
What should be restricted if an immediate fix is unavailable?
Restrict authenticated access to the affected delivery-note workflow and limit who can create or modify records through /Terceros/Create, particularly the Observaciones field. Review existing records created through that functionality for potentially malicious stored script content before users view them.