It’s possible to inject code in login screen using message and plug GET parameters, and server POST parameters.