Administrative account compromise via stored login-log XSS

Stored XSS in Pichome 2.1.0 and earlier allows remote attackers to execute JavaScript in an administrator's browser through login logs. The login form stores insufficiently sanitized username or password input in the login log, and the admin panel renders it as active script. No account is required to submit the payload, but an administrator must view the affected logs; script execution occurs in that browser context.