A stored Cross‑Site Scripting flaw exists in the delivery note editing component of AM System's ALO Suite. Unsanitized user‑supplied data is persisted and later rendered in other users’ browsers, allowing an attacker to inject and execute arbitrary JavaScript in the victim’s session. This can modify page content and trigger actions on behalf of the user, potentially compromising confidentiality, integrity, or performing unauthorized operations.

The affected product is AM System's ALO Suite, specifically version 25_09_15.03_35. The vendor has released a fixed build, 26_04_15.03_10, in April 2026.

The CVSS v3 score of 5.1 indicates a moderate risk level, while the EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires authenticated access to the delivery note editing functionality; an attacker with valid user credentials can inject malicious script that then runs in the browser context of other users who view the edited records. Based on the requirement for authentication and the lack of public evidence of widespread use, the threat may be limited to environments where many users have edit privileges or where privileged credentials are shared.