A security vulnerability in the OBlog application allows an attacker to manipulate the 'day' argument in /tags.php, causing unfiltered user input to be rendered in the browser. The flaw is a classic reflected cross‑site scripting (CWE‑79) that can be triggered remotely by crafting a URL with malicious payloads in the 'day' parameter. Exploiting the vulnerability could enable session hijacking, defacement, or the execution of arbitrary JavaScript within the victim’s browser, but it does not grant direct code execution on the server.

The issue affects ttttonyhe's OBlog up to the commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f. Because OBlog follows a rolling release model, exact version numbers are not disclosed; any release derived from the affected snapshot is vulnerable. Administrators should verify that their deployment includes that commit or an earlier unpatched state.

The CVSS score is 5.3, indicating a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote; an attacker can trigger the flaw from outside the host by sending a crafted request. The lack of an publicly available patch and the rolling release process increase uncertainty about the exact scope of vulnerable systems.