Stored script execution via unescaped facility names

Stored cross-site scripting in SHIRASAGI 1.16.2 and earlier allows remote authenticated users to execute script in another user's browser. The Schedule facility selector inserts a stored equipment name into the page as HTML instead of text, so markup in that name becomes executable content. An attacker must log in, create a facility with a script-bearing name, and induce another logged-in user to select that facility while creating a schedule.