The vulnerability resides in the Save method of the /blog/bContent/save component of lcg0124:BootDo. When an attacker manipulates the content, author, or title arguments, the application fails to escape or sanitize user input, permitting arbitrary script injection. This flaw enables an attacker to execute JavaScript in the browser of any user who views the affected content, potentially leading to session hijacking, credential theft, or defacement. The flaw is classified as a remote XSS and can be exploited by sending crafted requests to the vulnerable endpoint.

lcg0124:BootDo is affected, including all releases up to commit e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. The product follows a rolling‑release model with no explicit version numbering for the affected release, so any deployment of this code base is potentially vulnerable.

The CVSS score of 5.1 indicates a moderate severity. The EPSS probability of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. However, a public exploit is available, and remote exploitation is possible by submitting a malicious payload to the Save endpoint. An attacker does not need privileged access and can target any user who subsequently views the injected content.