EUVD-2026-53683
GHSA-h4fj-xv6r-wvv7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered reflected XSS requires victim interaction (UI:R) and changes scope to the victim's browser (S:C), yielding typical low confidentiality and integrity impact with no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized day parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.
Technical ContextAI
OBlog is a PHP-based blogging platform maintained by ttttonyhe using a rolling release model with no discrete version tags. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a failure to apply output encoding before echoing user-supplied input into the HTML response. Specifically, the day GET parameter in /tags.php is reflected without htmlspecialchars() or equivalent sanitization. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P/E:P confirms network-accessible, low-complexity exploitation requiring only victim interaction, consistent with a standard reflected XSS pattern. No authentication is required of the attacker.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to coordinated disclosure. Operators should apply output encoding directly in /tags.php by wrapping all rendering of the day parameter with PHP's htmlspecialchars($day, ENT_QUOTES, 'UTF-8') - this is the minimal targeted fix with no functional side effects for valid date inputs. As a network-layer compensating control, deploy a WAF rule to strip HTML metacharacters (< > " ' &) from the day parameter on requests to /tags.php; note that overly broad WAF rules may reject legitimate date-format inputs. Restrict public access to /tags.php at the web server level if tag-browsing by anonymous users is not required - this eliminates the attack surface entirely for unauthenticated exploitation. Monitor the upstream repository beyond commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f for any remediation commits. The public POC is documented at https://gist.github.com/hackusman/a1ba43253d6a62ace31ef39ec325e973.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today