The flaw is a stored Cross‑Site Scripting vulnerability in the delivery note feature of ALO Suite. Insufficient sanitization lets authenticated users inject JavaScript that is then served to any user who views the affected records. The script can modify page content and perform actions in the context of the victim’s session, effectively enabling an attacker to alter displayed data or hijack the victim’s session. The weakness is categorized as CWE‑79.

The vulnerability affects AM System’s ALO Suite, specifically versions up to 25_09_15.03_35. The vendor has released a fix in version 26_04_15.03_10, which should be deployed to mitigate the issue.

The CVSS score of 5.1 indicates moderate risk, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the delivery note functionality, so users with valid credentials can inject malicious code. An attacker would need to log in with a legitimate account, then submit a payload via the delivery note interface. Once stored, the code runs in the browsers of other authenticated users who view the note, giving the attacker the ability to manipulate content or hijack sessions. Given the moderate severity and the lack of publicly available exploit code, the likelihood of exploitation is limited but still notable in an environment where users frequently access delivery notes.