This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Repasat application. Specifically, the 'nomTamano' parameter in the '/es/companysizebills/store' endpoint is vulnerable to Cross-Site Scripting, which could enable an attacker to inject malicious scripts that execute in the context of the victim's browser session.

Successful exploitation could allow an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS score of 4.8 indicates a medium impact with network attack vector, low privileges required, and user interaction needed.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using or exposing the vulnerable parameter to untrusted input.