This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Repasat application. The affected parameter 'nomOrigen' in the endpoint '/es/origins/store' does not properly sanitize user input, enabling Cross-Site Scripting attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and low impact on confidentiality and integrity.

Successful exploitation could allow an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is rated medium, reflecting limited scope or complexity.

No patch or official remediation information is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the affected endpoint and avoid untrusted input.