The vulnerability is a stored cross‑site scripting flaw that permits attackers to embed JavaScript into the SABBATIC application. When a victim views the affected page, the script runs in their browser. This can lead to session hijacking, defacement, or manipulation of the user interface. The weakness is identified as CWE‑79, indicating improper input handling and lack of output encoding.

The flaw exists in SABBATIC's SABBATIC app in versions prior to 7.96.0.1 and 7.96.0.2 as listed in the CPE string. Users running these releases are impacted. The affected endpoint is "/categorías", where parameters 'titulo_es' and 'add_etiquetas[]' can be used to store the malicious code.

The CVSS score of 4.8 indicates a moderate risk. EPSS is not available, so no estimate of current exploitation probability is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated application user submitting the malicious payload via the categories endpoint; any user who views the page thereafter will have the code executed. Because the vulnerability relies on user‑supplied data and requires persistent storage, exploitation does not require privileged or remote exploitation capabilities beyond the application’s normal user access level.