Verba’s login logging mechanism stores the user‑supplied username unfiltered when a login attempt fails. An unauthenticated remote attacker can insert a malicious XSS payload into the username field, which is then persisted to the application logs. When an administrator later accesses the log viewer, the injected script executes in the administrator’s browser.

Verint’s Verba application is affected. All releases prior to version 10.0.6 contain the flaw; the issue was corrected in 10.0.6.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the flaw remotely without authentication by submitting a crafted username during a failed login attempt. When admins subsequently visit the log viewer, the payload will execute in their browser.