Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')