Session-token theft via reflected log filename

Reflected XSS in OpenCart 4.0.0.0 and later allows remote attackers to steal an administrator's session token through a crafted admin log URL. The admin tool/log route renders the filename parameter without adequate output encoding, while login.php preserves the attacker-controlled route and query in a post-login redirect. Exploitation requires knowledge of the admin path and victim interaction; an already authenticated administrator remains exposed to script execution in the administrative origin.