This vulnerability is a stored XSS issue in the TPVEnlanube Cloud Web application, specifically in the 'Apellido 1' parameter of the user administration add page. It allows an authenticated attacker to inject malicious code that is stored and later executed in the context of other users' browsers when they access the affected page. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, user interaction required, and limited impact on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of arbitrary scripts in users' browsers, potentially enabling session hijacking, defacement, or other malicious actions within the context of the affected web application. However, the impact is limited by the requirement for attacker authentication and user interaction.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and consider implementing input validation or output encoding as a temporary mitigation.