The vulnerability is a stored XSS flaw in the delivery note feature of AM System’s ALO Suite. Insufficient sanitization and encoding of the Observaciones field allows attackers to embed JavaScript that remains stored in the database and executes inside the browsers of any user who views the affected record. Because the code runs within the context of the victim’s authenticated session, it can modify page content, trigger actions on behalf of the user, or perform other malicious tasks without the user’s knowledge. This bug falls under CWE-79.

The affected product is AM System ALO Suite, with the vulnerable build identified by the version symbol 25_09_15.03_35. The manufacturer has released an updated build, 26_04_15.03_10, that resolves the stored XSS issue.

The CVSS score of 5.1 indicates a moderate severity attack. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower current exploitation prevalence. Exploitation requires authenticated access to the delivery note functionality; an attacker with legitimate credentials or who can obtain them can inject script into the Observaciones field. Once stored, the script will execute in any browser that opens the associated record, enabling session‑level data theft or other malicious actions.