Stored Cross-Site Scripting Vulnerability in Alosuite by AM Systems

CVE-2026-108059

What is CVE-2026-108059?

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite allows malicious actors to inject JavaScript code into the delivery note functionality. Due to insufficient sanitization and encoding, harmful scripts can be stored and executed in the browsers of unsuspecting users when they access affected records. Exploitation of this vulnerability requires authenticated access, enabling attackers to manipulate displayed content and execute actions in the context of the victim's session. This poses a significant risk, particularly in environments where sensitive information is handled.

References