This vulnerability is an improper neutralization of input during web page generation (CWE-79) in the Repasat application. Specifically, the 'nomGrupoEmpresarial' parameter at the endpoint '/es/corporategroups/update/246' is susceptible to Cross-Site Scripting. Successful exploitation enables an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking or other client-side attacks. The CVSS v4.0 score is 4.8, indicating medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of a victim's browser session when the victim interacts with a crafted input. This could lead to unauthorized actions performed on behalf of the user or theft of sensitive information accessible in the browser context. The impact is limited by the requirement for user interaction and low integrity and confidentiality impact.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when interacting with untrusted inputs in the affected parameter and endpoint.