A stored Cross-Site Scripting (XSS) vulnerability exists in the SABBATIC application at the /mis-gastos endpoint via the 'observaciones' parameter. This flaw allows attackers to inject and store malicious JavaScript code that executes in the browser of any user who views the affected page. The vulnerability has a medium severity rating with a CVSS score of 4.8. No affected versions or patches are specified in the available data.