This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Repasat application. Specifically, the 'nomServicioPrestado' parameter in the '/es/providedservices/store' endpoint is vulnerable to Cross-Site Scripting. Successful exploitation enables an attacker to inject malicious scripts that execute in the context of the victim's browser, potentially leading to unauthorized actions or data exposure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low impact on confidentiality and integrity.

An attacker exploiting this vulnerability could execute arbitrary code in the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected web application. The impact is limited by the need for user interaction and the low confidentiality and integrity impact scores.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, users should exercise caution with untrusted input in the affected parameter and consider implementing input validation or output encoding as temporary mitigations.