AM System
Vulnerability activity for AM System: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 15
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 15
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 15
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108060A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108059A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108058A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108057A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108056A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108055A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108054A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108053A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108052A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108051A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO Suite XSSCVE-2026-108050A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endp
- 5.1MediumNov 3, 2026AM System ALO SuiteCVE-2026-108049Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could
- 6.9MediumNov 3, 2026AM System ALO Suite Denial of serviceCVE-2026-108048Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or o
- 8.6HighNov 3, 2026AM System ALO Suite Auth bypass / access controlCVE-2026-108047Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful explo
- 6.9MediumNov 3, 2026AM System ALO Suite Auth bypass / access controlCVE-2026-108046Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, result
Top products
- ALO Suite15 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- ENISA EUVD · Nov 3, 2026EUVD-2026-115809 · A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note…CVE-2026-108060
- ENISA EUVD · Nov 3, 2026EUVD-2026-115808 · A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note…CVE-2026-108059
- ENISA EUVD · Nov 3, 2026EUVD-2026-115807 · A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note…CVE-2026-108058
- ENISA EUVD · Nov 3, 2026EUVD-2026-115806 · A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note…CVE-2026-108057
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.