alo_suite vulnerabilities
CVEs whose affected-version data names the alo_suite package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
15 CVEsRSS
CVE-2026-108060Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108059Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108058Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108053Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108057Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108056Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108052Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108055Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108054Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108051Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108050Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108049Medium· 5.1Clickjacking vulnerability in the Alosuite web application.
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-F…
CVE-2026-108048Medium· 6.9Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single …
CVE-2026-108046Medium· 6.9Direct Object Reference (IDOR) vulnerability in Alosuite
Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access inf…
CVE-2026-108047High· 8.6Inadequate authorization vulnerability in Alosuite’s user invitation functionality
Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the inv…