Administrator session theft via stored token XSS

Stored XSS in Maximilian Vogt cmaps 8.0 allows remote attackers to steal an administrator's session cookie through the audit log. The /rest/update/ endpoint stores the token parameter without sanitization, and the auditlog tab inserts that value directly into the rendered page. An administrator must open or refresh the audit log, after which the injected script executes in that administrator's browser context.