Threats tagged 'ghsa-37cc-rw3j-pvqf'

CVE-2026-108050 is a stored Cross-Site Scripting (XSS) vulnerability in Alosuite affecting the delivery note functionality. It arises from insufficient sanitization and encoding of the ReferenceOtherParty field in the delivery note edit endpoint. An authenticated user can inject JavaScript code that executes in other users' browsers when viewing affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.