The vulnerability is a stored Cross‑Site Scripting flaw in the delivery note functionality of AM System’s ALO Suite. The application fails to properly sanitize and encode user input, allowing JavaScript to be stored in specified fields. When a different user views the affected record, the malicious script executes in that user’s browser, enabling the attacker to alter the displayed content and carry out actions within the victim’s session.

AM System ALO Suite version 25_09_15.03_35 is impacted. The public patch is available in release 26_04_15.03_10, which addresses the identified input handling issue. Users on any earlier build that retains the vulnerable rendering logic remain exposed.

The CVSS score of 5.1 indicates a moderate severity, and no EPSS value is reported, suggesting low publicly known exploitation activity. Exploitation requires the attacker to have authenticated access to the delivery note creation feature. Once the data is stored, any subsequent user who opens the record will suffer the injected code, potentially leading to session hijacking or other malicious actions within their session. Due to the lack of known public exploits and the need for internal access, the overall risk can be considered moderate, but the impact on affected users is non‑trivial.