Oblog
Monthly
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.