Administrator session compromise via unsanitized login logs

Stored blind XSS in Froxlor before 2.1.9 allows remote attackers to execute script in an administrator's browser through failed-login logs. The login handler writes the unauthenticated loginname value into log text, where crafted Vue.js interpolation bypasses XSS filtering and runs when System Logs renders it. Execution requires an administrator to open System Logs and can issue authenticated actions in that session, including creating an attacker-controlled administrator account.