Verint Verba contains a stored XSS vulnerability (CWE-79) in its login logging feature. When an attacker submits a login attempt with a crafted username containing malicious script, this input is logged without proper sanitization. Later, when an administrator views the logs via the web interface, the malicious script executes in the admin's browser context. This allows potential execution of arbitrary script code in the administrator's session. The issue was reported to the vendor, who did not respond initially, but the vulnerability was addressed in version 10.0.6.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary script code in the context of the administrator's browser when viewing application logs. This could lead to session hijacking, unauthorized actions, or other attacks leveraging the administrator's privileges within the web application. The vulnerability does not require prior authentication and has a medium severity rating (CVSS 5.3).

Upgrade Verint Verba to version 10.0.6 or later, where this vulnerability has been fixed. Since the vendor has released an official fix, applying this update is the recommended remediation. Until the update is applied, restrict access to the log viewer interface to trusted administrators only and consider additional monitoring for suspicious login attempts.