Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 15

Export CSV
CVE-2026-108047

Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108060

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108059

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108059: Observaciones in ‘/Terceros/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108058

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108057

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108056

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108056: NombrePF in ‘/Empresas/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108055

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108054

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108053

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108052

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108051

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108050

Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108049

Clickjacking vulnerability in the Alosuite web application.

Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108048

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.

Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite
CVE-2026-108046

Direct Object Reference (IDOR) vulnerability in Alosuite

Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Am System
Products
Alo Suite