The vulnerability allows an attacker to store malicious JavaScript code in the 'companyName' parameter of the /empresa endpoint. When a user later views a page that displays this stored value, the code executes within that user’s browser, enabling script‑based attacks such as session hijacking or defacement.

SABBATIC’s SABBATIC application, for all releases earlier than version 7.96.0.1 or 7.96.0.2. Updated releases 7.96.0.1 and 7.96.0.2 contain the fix.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not publicly available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject data via the 'companyName' field, typically by submitting a crafted form or exploiting a similar input. Once stored, the malicious script runs in any user’s browser that views the data, leading to potential credential theft or further lateral movement.