This vulnerability is an instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Cross-Site Scripting flaw in the Repasat application. The affected parameter is 'nomDelegacion' in the '/es/delegations/store' endpoint. Successful exploitation enables an attacker to execute arbitrary scripts in the context of the victim's browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required but user interaction needed, and low impact on confidentiality, integrity, and availability.

An attacker exploiting this vulnerability could execute arbitrary code in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the user's context. However, the impact is rated medium due to the requirement of user interaction and limited impact on system confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should exercise caution when interacting with untrusted inputs in the affected application.