The vulnerability is a stored cross‑site scripting flaw that allows an attacker to embed malicious JavaScript code into the ‘observaciones’ parameter of the /mis‑gastos endpoint. When a legitimate user later views the page, the stored script executes in the victim’s browser, potentially enabling session hijacking, credential theft, or defacement. This weakness falls under CWE‑79, indicating improper input validation and output encoding.

The flaw exists in all SABBATIC application releases preceding version 7.96.0.1 and 7.96.0.2, meaning any older installations are affected.

The CVSS score of 4.8 reflects a moderate risk: it does not provide privilege escalation or remote code execution, but it can compromise confidentiality and integrity of user sessions. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. It is likely to be exploited via the web interface by submitting crafted input to the ‘observaciones’ field, after which unsuspecting users are exposed to the injected code.