A stored Cross‑Site Scripting vulnerability exists in the delivery note feature of Alosuite. The flaw originates from insufficient sanitization and encoding of input fields, allowing an attacker to embed JavaScript that is persisted and later rendered in the browsers of other authenticated users. When those users view the affected records, the malicious code runs, potentially modifying page content or performing actions using the victim’s authenticated session. This enables attackers to hijack user sessions, deface, or capture credentials without needing to exploit other weaknesses.

The vulnerability affects AM System: ALO Suite, particularly versions identified by the CPE cpe:2.3:a:am_system:alo_suite:25_09_15.03_35 and earlier. The manufacturer released a fix in version 26_04_15.03_10 in April 2026, which addresses the insecure input handling in the delivery note functionality.

The CVSS score is 5.1, indicating moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability today. Exploitation requires an authenticated user with access to create or edit delivery notes. The attack can be carried out by submitting malicious content through the delivery note interface, which is then stored and rendered when other users view the record. The mitigated risk hinges on the presence of the patch or the implementation of input sanitization controls.