Stored XSS Vulnerability in Alosuite Affecting Delivery Note Functionality

CVE-2026-108054

What is CVE-2026-108054?

A stored Cross-Site Scripting (XSS) vulnerability exists in Alosuite's delivery note functionality due to inadequate sanitization and encoding of specific input fields. This flaw permits malicious JavaScript to be stored and subsequently executed in other users' web browsers when they access affected records. Users need to be authenticated to exploit this vulnerability, which can manipulate displayed content and execute actions within the context of an active session. The vulnerable endpoint includes, but is not limited to, the 'Nombre' field in the '/Familias/Edit/{id}' path.

References