The vulnerability allows an attacker to inject and store malicious JavaScript code in the SABBATIC application’s database. When a user later views the affected page, the script runs in that user’s browser, potentially leading to cookie theft, credential compromise, or further malware delivery. This is a classic stored XSS flaw, classified as CWE‑79.

All SABBATIC application releases earlier than version 7.96.0.1 y 7.96.0.2 are impacted. The flaw exists in the 'nombre' parameter on the '/usuario' endpoint, which accepts unsanitized user input.

With a CVSS score of 4.8 the risk is medium; the EPSS score is not reported, and it is not listed in CISA's KEV catalog. The exploitation likely requires remote access to the application’s web interface, where an attacker can submit crafted input to the 'nombre' field and then wait for a legitimate user to load the stored data.