This vulnerability is an instance of CWE-79: improper neutralization of input during web page generation, specifically a Cross-Site Scripting flaw in the Repasat application. The affected parameter is 'nomCompetidor' in the endpoint '/es/competitors/store'. Successful exploitation enables an attacker to inject and execute arbitrary scripts in the context of the victim's browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

An attacker exploiting this vulnerability could execute arbitrary code in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser context. The impact is limited by the requirement for user interaction and low impact on system confidentiality, integrity, and availability.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted inputs and consider implementing input validation or output encoding as temporary mitigations if possible.