The vulnerability is a stored XSS flaw in the delivery note functionality of Alosuite. Insufficient sanitisation allows malicious JavaScript to be persisted in database‑backed fields; when other users view the affected records the code executes in their browsers. The attack requires authenticated access to the feature and can be used to alter displayed content or perform actions within the victim’s session.

Alosuite from AM System, specifically versions prior to 26_04_15.03_10—including the version 25_09_15.03_35 identified in the CPE—are affected. Any build containing the delivery note functionality without the patch is vulnerable.

The CVSS score of 5.1 places this issue in the moderate severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalogue. Attackers can exploit the flaw by authenticating to the application and inserting malicious payloads that later execute against other users, potentially hijacking sessions or manipulating content. The risk is confined to users who view the stored data and not to system‐wide compromise.