AM System ALO Suite web app multiple flaws
Business web software here can leak data and let accounts be taken.
Summary
The ALO Suite web application has missing permission checks, information exposure and stored XSS flaws among others. Records say an attacker could view other companies' and users' data or gain account privileges.
Affected when
- Stored XSS flaws require a logged-in account
What to do
No source names a fixed version. If you run 25_09_15.03_35, check the vendor's advisory and update.
Products and platforms
CVE IDs
- CVE-2026-108046 (opens in a new tab)
- CVE-2026-108047 (opens in a new tab)
- CVE-2026-108048 (opens in a new tab)
- CVE-2026-108049 (opens in a new tab)
- CVE-2026-108050 (opens in a new tab)
- CVE-2026-108051 (opens in a new tab)
- CVE-2026-108052 (opens in a new tab)
- CVE-2026-108053 (opens in a new tab)
- CVE-2026-108054 (opens in a new tab)
- CVE-2026-108055 (opens in a new tab)
- CVE-2026-108056 (opens in a new tab)
- CVE-2026-108057 (opens in a new tab)
- CVE-2026-108058 (opens in a new tab)
- CVE-2026-108059 (opens in a new tab)
- CVE-2026-108060 (opens in a new tab)
Sources
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen