EUVD-2026-14672
GHSA-cvg8-pgv5-2vg3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in bolo-blog 까지 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
A cross-site scripting (XSS) vulnerability exists in bolo-blog version 2.6.4 in the Article Title Handler component at /console/article/, where the articleTitle parameter is not properly sanitized before being rendered. An authenticated attacker with high privileges can inject malicious JavaScript through the articleTitle argument, resulting in stored or reflected XSS that compromises the integrity of the application. A proof-of-concept exploit has been publicly released on GitHub, and the vendor has not yet responded to early disclosure notifications.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a common web application flaw where user-controlled input is rendered in HTML context without proper output encoding. The affected component is the Article Title Handler function within bolo-blog's /console/article/ endpoint, which fails to escape or sanitize the articleTitle parameter before inclusion in the HTTP response. Bolo-blog (cpe:2.3:a:n/a:bolo-blog:*:*:*:*:*:*:*:*) is a blog platform where articles are managed through web-based administrative interfaces. The lack of input validation and output encoding allows attackers to break out of intended HTML context and execute arbitrary client-side scripts in the browser of any user viewing the affected page.
RemediationAI
The primary remediation is to upgrade bolo-blog to a patched version released by the maintainers; contact the bolo-blog project at https://github.com/bolo-blog/bolo-solo/issues/330 for patch availability and expected release timeline, as the vendor has not yet formally responded. Interim mitigation measures include implementing a Web Application Firewall (WAF) with XSS detection rules to filter malicious input patterns in the /console/article/ endpoint, restricting administrative console access to trusted IP ranges and VPN-only connectivity, and enforcing strong Content Security Policy (CSP) headers to limit inline script execution. Ensure all administrative accounts use strong, unique credentials and enable multi-factor authentication if available. Do not delay patching once updates become available, as the public exploit code increases the likelihood of opportunistic attacks against unpatched instances.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today