PULSE
EN
FEED
ransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · USransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · US
← Todos los CVEs
CVE Watch3 nov 2026

CVE-2026-108055

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and en

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 3 nov 2026 · Última mod.: 3 nov 2026 · CWE-79

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1215886.1 MED
—
———TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.6hCVE-2026-1208436.5 MED
—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.6hCVE-2026-1195216.5 MED
—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.6hCVE-2026-1141856.5 MED
—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.6hCVE-2026-1215515.4 MED
—
———PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.6hCVE-2026-1214476.1 MED
—
———svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.8h