Threats tagged 'ghsa-w4vf-pvj6-73g5'

CVE-2026-108054 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of the 'Nombre' field in the '/Familias/Edit/{id}' endpoint. An authenticated user can inject JavaScript code that is stored and later executed in other users' browsers when viewing the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.