This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the TPVEnlanube Cloud Web application. Specifically, the 'Nombre Completo' parameter in the administrative user list endpoint is vulnerable to stored XSS. An attacker with authentication privileges can inject malicious code that will be stored and executed in the context of other users' browsers when they access the affected page.

Successful exploitation allows an authenticated attacker to execute arbitrary scripts in the browsers of other users, potentially leading to session hijacking, defacement, or other malicious actions executed with the victim's privileges. However, the attack requires authentication and user interaction (UI:A), limiting the scope of impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected administrative endpoint to trusted users only and consider applying web application firewall (WAF) rules to detect and block malicious input targeting the 'Nombre Completo' parameter.