Administrator-session script execution via reflected search input

Reflected XSS in Dotclear 2.29 Admin Panel search allows remote attackers to run script in an administrator's browser via a crafted link. The public disclosure identifies the search response as the reflection point but does not identify the request parameter or encoding operation that fails to neutralize it. Exploitation requires an authenticated administrator to follow the attacker-supplied URL; resulting script runs in the administration origin and can read or alter data available to that session.