Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108049— Clickjacking vulnerability in the Alosuite web application.

Quick assessment

Affected
AM System ALO Suite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Alosuite Web 应用存在点击劫持漏洞。受影响的登录界面可被嵌入到攻击者控制的网页中，原因是该界面未实施足够的用户界面保护机制，例如未设置 X-Frame-Options 响应头，也未配置适当的 Content-Security-Policy（frame-ancestors）指令。攻击者可通过诱骗受害者与恶意网页进行交互，触发嵌入在框架中的 Alosuite 应用内的非预期操作，从而破坏用户交互的完整性，并进一步对已认证用户发起攻击。

CVSS 5.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Clickjacking vulnerability in the Alosuite web application.
Source: CVE Program / CVE List V5
Vulnerability Description
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不当限制渲染UI层或帧
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AM System ALO Suite 25_09_15.03_35 -

II. Public POCs for CVE-2026-108049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108049

请登录查看更多情报信息。

Other References for CVE-2026-108049 (1)

Same Patch Batch · AM System · 2026-11-03 · 15 CVEs total

CVE-2026-108047 8.6 HIGH Inadequate authorization vulnerability in Alosuite’s user invitation functionality
CVE-2026-108048 6.9 MEDIUM Vulnerability due to a lack of request limits in Alosuite’s password recovery functionalit
CVE-2026-108046 6.9 MEDIUM Direct Object Reference (IDOR) vulnerability in Alosuite
CVE-2026-108056 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108057 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108059 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108053 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108058 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108051 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108060 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108055 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108052 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108050 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note
CVE-2026-108054 5.1 MEDIUM Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note

IV. Related Vulnerabilities

Same product: ALO Suite
Same vendor: AM System
Same weakness: CWE-1021