Threats tagged 'ghsa-c95q-p48h-92rh'

CVE-2026-108057 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of user-supplied input in the 'Nombre' field at the endpoint '/PlantillasPdf/Edit/1273129'. An authenticated user can inject malicious JavaScript code that executes in other users' browsers when viewing affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or remediation information is currently provided.