AM System has 15 CVEs on record. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 15. The median CVSS is 5.1 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (11).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.1
- Publish → KEV
- —
- Last 90 days
- 15 prev 0
Weakness classes
Products
- ALO Suite 15
Worst active — by depth score
CVE-2026-108047High· 8.6Inadequate authorization vulnerability in Alosuite’s user invitation functionality47CVE-2026-108048Medium· 6.9Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.38CVE-2026-108046Medium· 6.9Direct Object Reference (IDOR) vulnerability in Alosuite38CVE-2026-108060Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.28CVE-2026-108059Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.28
AM System vulnerabilities
CVEs affecting AM System, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-108060Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108059Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108058Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108053Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108057Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108056Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108052Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108055Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108054Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108051Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108050Medium· 5.1Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ brow…
CVE-2026-108049Medium· 5.1Clickjacking vulnerability in the Alosuite web application.
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-F…
CVE-2026-108048Medium· 6.9Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single …
CVE-2026-108046Medium· 6.9Direct Object Reference (IDOR) vulnerability in Alosuite
Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access inf…
CVE-2026-108047High· 8.6Inadequate authorization vulnerability in Alosuite’s user invitation functionality
Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the inv…