Administrator script execution via stored console input

Stored XSS in the Absolute Secure Access console before 13.06 allows remote authenticated users to execute script in an administrator's browser. The console temporarily stores a limited-length script from a tunnel session without neutralizing it and renders it as a clickable item. Exploitation requires valid tunnel credentials, an active attacker session, an administrator click, and a non-default configuration; the reported consequence is integrity loss without confidentiality or availability impact.