An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on the server, due to the lack of proper sanitisation of field elements, allowing the attacker to trigger the malicious payload when the application loads.
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repox