Administrator-context script execution via unsanitized login logs

Stored XSS in Verint Verba before 10.0.6 allows remote attackers to execute script in an administrator's browser through failed logins. The login logger records an incorrect username without sanitization, and the log viewer renders the stored value as active browser content. Exploitation requires no account to plant the payload, but an administrator must later open the application log viewer; the resulting script runs in that administrator's web context.