A stored Cross-Site Scripting (XSS) vulnerability exists in the SABBATIC application. This flaw allows an attacker to inject and store malicious JavaScript code via the 'nombre' parameter on the '/usuario' endpoint. When a user views the affected page, the stored script executes in their browser context. The vulnerability has a medium severity rating with a CVSS score of 4.8.