A stored Cross-Site Scripting (XSS) vulnerability exists in the SABBATIC application, specifically in the 'companyName' parameter of the /empresa endpoint. This flaw allows an attacker to inject and store malicious JavaScript code that executes in the browser of any user who views the affected page. The vulnerability has a medium severity rating with a CVSS score of 4.8.