Victim-context script execution via unsanitized resource names

Stored XSS in OpenOlat 18.1.4 and earlier allows remote authenticated users to run JavaScript in another user's browser. Course, catalog, curriculum, and media alt-text names are stored without adequate filtering or sanitization and later rendered in victim-facing views. The attacker needs the relevant content-creation or editing right, and exploitation requires a victim to open an affected editing, publishing, or management view; the script acts with that victim's application permissions.