Threats tagged 'ghsa-fp95-25qw-hx2w'

CVE-2026-108059 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. It arises from insufficient sanitization and encoding of user input in the 'Observaciones' field at the '/Terceros/Create' endpoint. An authenticated user can inject JavaScript code that executes in other users' browsers when they view the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.