Stored Cross-Site Scripting Vulnerability in Alosuite by AM Systems

CVE-2026-108060

What is CVE-2026-108060?

Alosuite, developed by AM Systems, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability that compromises the delivery note functionality. This weakness arises from inadequate sanitization and encoding of user-supplied input, specifically the 'Nombre' field during the creation of worker records. As a result, malicious JavaScript can be inadvertently stored and executed in the browsers of users who view the impacted records. Exploiting this vulnerability necessitates authenticated user access, allowing an attacker to manipulate displayed content and execute unauthorized actions within the victim's session.

References