A stored Cross‑Site Scripting vulnerability in the delivery note functionality of Alosuite allows attackers to inject malicious JavaScript via unsanitized input fields. The script is persisted to the database and later executed when other users retrieve and view the affected record. This enables an attacker to alter displayed content and perform arbitrary browser‑side actions within the victim’s authenticated session, such as stealing session cookies or carrying out phishing or social engineering attempts.

The product affected is AM System’s Alosuite, specifically configurations preceding the patch released in April 2026 (e.g., the CPE indicates version 25_09_15.03_35 is vulnerable). The manufacturer’s fix is available in version 26_04_15.03_10 of Alosuite and subsequent releases.

The reported CVSS score of 5.1 indicates moderate severity. Exploitation requires the attacker to authenticate to Alosuite and use the delivery note editing feature, so the attack vector is application‑based and limited to legitimate user sessions. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet observed. Nevertheless, the ability to execute arbitrary JavaScript in a user’s browser can still be leveraged for session hijacking, data theft or defacement within the scope of the affected organization.