A stored Cross‑Site Scripting vulnerability in ALO Suite allows malicious JavaScript to be saved in fields used by the delivery note functionality. When other authenticated users view the affected records, the browser executes the script in the context of the victim’s session, enabling attackers to modify displayed content or perform actions on behalf of the user.

This issue affects AM System ALO Suite version 25_09_15.03_35, which is included in the impacted CPE string. The manufacturer has released a fix in version 26_04_15.03_10, available since April 2026.

The vulnerability has a CVSS score of 5.1, indicating moderate risk. EPSS data is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires authenticated access to the delivery note functionality; once achieved, the attacker can execute arbitrary scripts in the browser of any user who views the compromised record, potentially leading to session hijacking, defacement, or data theft. The attack vector is therefore likely internal and depends on privileged user credentials.