Administrator account takeover via unencoded log entries

Stored cross-site scripting in CI4MS before 0.31.0.0 allows remote authenticated users to hijack administrator sessions through logged data. The Logs module inserts attacker-controlled error-message content into its administrative viewer without output encoding, so a stored payload executes as browser code. A low-privileged account must place a payload in application logs, and an administrator must later open the logs page; execution can expose or alter that administrator's account data.