{"id":"CVE-2026-108060","kind":"vulnerability","aliases":["CVE-2026-108060"],"related":[],"title":"Alosuite: stored script injection in delivery note records","description":"A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.","summary":"Alosuite stores unsanitized input in the delivery note feature, so JavaScript saved by one user runs in other users' browsers when they view those records. An attacker can act within the victim's session, altering displayed content and performing actions as them.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alosuite","delivery-notes","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T13:17:19+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","triaged_at":"2026-11-03T13:21:34+00:00","updated_at":"2026-11-03T13:21:34+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T13:21:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Alosuite: stored script injection in delivery note records","impact":"medium","summary":"Alosuite stores unsanitized input in the delivery note feature, so JavaScript saved by one user runs in other users' browsers when they view those records. An attacker can act within the victim's session, altering displayed content and performing actions as them.","audience":"businesses","category":"other","nicknames":[],"who_cares":["alosuite","delivery-notes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Stored script runs in users' sessions and performs actions as them","analyst_note":"Find affected and fixed Alosuite versions and check the NVD entry for CVSS details at https://nvd.nist.gov/vuln/detail/CVE-2026-108060.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Alosuite with the delivery note functionality and the Nombre field at /Trabajadores/Create exposed to authenticated users. Sources do not say which Alosuite versions are affected or whether the flaw is reachable beyond logged-in users.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":4214,"output_tokens":456,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108060':11A,14A,138C '-2026':10A,13A,137C '/trabajadores/create':141C 'access':103C 'act':47B 'action':58B,117C 'affect':70C,98C,106C 'allow':83C 'alosuit':1A,15B,19B,68C 'alter':53B,111C 'attack':45B 'authent':102C 'browser':38B,93C 'code':109C 'content':55B,114C 'context':120C 'cross':62C 'cross-sit':61C 'cve':9A,12A,136C 'deliveri':6A,17B,25B,72C 'delivery-not':16B 'display':54B,113C 'encod':78C 'endpoint':132C 'execut':89C 'exploit':100C 'featur':27B,129C 'field':82C 'follow':135C 'function':74C,107C 'inject':4A 'input':22B 'insuffici':75C 'javascript':29B,84C 'list':127C 'nombr':139C 'note':7A,18B,26B,73C 'one':32B 'paramet':130C 'perform':57B,116C 'record':8A,43B,99C 'requir':101C 'run':34B 'sanit':76C 'save':30B 'script':3A,64C 'session':52B,125C 'site':63C 'specifi':81C 'store':2A,20B,60C,87C 'unsanit':21B 'user':33B,37B,92C 'victim':50B,123C 'view':41B,96C 'vulner':66C 'within':48B,118C 'xss':65C","nicknames":[],"mitigations":[],"who_affected":"Teams running Alosuite with the delivery note functionality and the Nombre field at /Trabajadores/Create exposed to authenticated users. Sources do not say which Alosuite versions are affected or whether the flaw is reachable beyond logged-in users.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alosuite","deliverynotes","medium","other"],"first_public_at":"2026-11-03T13:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108060","severity":null,"published_at":"2026-11-03T13:17:19+00:00","modified_at":"2026-11-03T13:17:19+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","fetched_at":"2026-11-03T13:20:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}