The vulnerability is a stored XSS in the delivery note feature of AM System’s ALO Suite. Insufficient sanitization of input fields lets attackers inject JavaScript, which then executes in the browsers of other users who view the stored delivery note. This allows an attacker to modify displayed content or perform actions under the victim’s session.

The affected product is ALO Suite version 25_09_15.03_35. The working version that fixes the issue is 26_04_15.03_10. Only users with authenticated access to the delivery note functionality are impacted.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploitation requires an authenticated user, so broad unauthenticated attacks are not possible. An attacker who has legitimate credentials can inject malicious payloads; the payload runs in the victim’s browser, potentially leading to defacement or session hijack within the context of the victim’s session.