The Repasat application contains a Cross-Site Scripting (CWE-79) vulnerability in the 'nomTamano' parameter of the '/es/companysizebills/store' endpoint. This vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser upon successful exploitation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, required privileges and user interaction, and low impact on confidentiality and integrity, with medium severity overall. No known exploits or patches are currently documented.

Successful exploitation can lead to arbitrary code execution in the victim's browser, potentially enabling session hijacking, credential theft, or other malicious actions performed in the context of the affected web application. The impact is limited to client-side execution and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the affected endpoint, and administrators should monitor for suspicious activity related to this parameter. No official fix or workaround is currently documented.