Authenticated administrator-session script execution via stored event input

Stored XSS in Pandora FMS Console 766 and earlier allows remote authenticated users to execute script in an administrator's browser. The Create event form stores the free search field without neutralizing an injected XSS payload, which executes when an administrator opens the event from Event filter. A low-privileged authenticated account can create the event, but exploitation requires an administrator to select it; the resulting script runs in that administrator's web session.