CVE-2022-37059: Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel

The XSS occurs in the admin login field, indicating input from authentication forms is not properly sanitized before output. CMS admin controllers typically handle form processing and template rendering. The AdminController::login would process login attempts and potentially reflect input in error messages. The iaView::display function (common in MVC frameworks) would be responsible for final HTML generation - if it lacks contextual escaping for user-controlled data like login fields, XSS would occur. Confidence is high for the controller method due to the attack vector description, and medium for the view layer component as it's a common pattern though not explicitly confirmed.