Administrator-session script execution via logged username

Stored XSS in Sesami Cash Point & Transport Optimizer 6.3.8.6 allows remote attackers to execute JavaScript through the login form. The application records an unsanitized Username value in its application log and executes the stored payload when an administrator views logged authentication attempts. No account is required to plant the payload, but administrator interaction is required; execution occurs in the administrator's browser and can expose or modify data available to that session.