Administrator session theft via stored firstname script

Stored XSS in School Club Application System 0.1 allows remote attackers to execute script in an administrator's browser via firstname. The public club application form sends firstname to the save_application handler, which stores the value and later renders it without neutralizing HTML or script markup. No account is needed to submit the payload, but an administrator or club administrator must view the saved application; execution can expose that user's session cookie and permit account takeover.