Stored Cross-Site Scripting Vulnerability in Alosuite Affects Delivery Note Functionality

CVE-2026-108052

What is CVE-2026-108052?

A stored Cross-Site Scripting vulnerability exists in the Alosuite application affecting the delivery note functionality. Due to inadequate sanitization and encoding of user inputs in specified fields, malicious JavaScript can be stored and executed in the browsers of other users who view the affected delivery notes. This exploitation necessitates authenticated access to the delivery note feature and can lead to unauthorized modifications of displayed content as well as perform unintended actions in the context of the user's session. The vulnerability primarily resides in the endpoint '/CategoriasFicheros/Edit/{id}', posing significant risks to users' data privacy and application integrity.

References