Administrator session compromise via unencoded audit entries

Stored XSS in Dolibarr 10.0.6 allows remote authenticated users to execute script in an administrator's browser through the audit page. The failed-login handler records an attacker-supplied username in a USER_LOGIN_FAILED audit event, which the audit page renders without output encoding. USER_LOGIN_FAILED must be enabled and an administrator must view the stored entry; the script then runs in the administrator's session and can expose or alter account data.