Threats tagged 'ghsa-r27j-x4qx-6whm'

CVE-2026-108055 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of user-supplied input in the 'Nombre' field at the '/Inmuebles/Create' endpoint. An authenticated attacker can inject malicious JavaScript code that executes in the browsers of other users viewing the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.