CVE-2026-108060: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who view delivery note records containing attacker-controlled content are exposed to script execution in their browser. Exploitation requires an authenticated user who can access the affected functionality and submit content to the vulnerable field.
Which input is identified as vulnerable?
The affected input is the Nombre field at /Trabajadores/Create. The supplied data does not identify additional affected fields, parameters, or endpoints.
What can an attacker do through successful exploitation?
Stored JavaScript executes in the browser of users who view the affected record. It can alter displayed content and perform actions in the context of the victim's session.