CVE-2026-4616

bolo-blog Article Title article cross site scripting

View on CVE.org
Published Mar 24, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in bolo-blog up to 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability permits an attacker to inject malicious script through the articleTitle parameter in the /console/article/ endpoint. The Article Title Handler processes the input without proper sanitization, leading to client‑side script execution. The flaw corresponds to CWE‑79 and indicates misuse of code evaluation mechanisms (CWE‑94). Remote exploitation is possible by sending a crafted HTTP request containing malicious JavaScript.

Affected Systems

The flaw affects bolo‑blog versions up to 2.6.4. No other vendors or products are listed. The affected component is the Article Title Handler in the /console/article/ path of the bolo‑blog platform.

Risk and Exploitability

The CVSS base score of 4.8 points to moderate severity, while the EPSS score of less than 1% implies a low probability of widespread exploitation at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploitation can be performed by an attacker who sends a malformed articleTitle value to the exposed endpoint, and the resulting cross‑site scripting can be leveraged to execute arbitrary JavaScript in the victim’s browser.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a vendor patch or upgrade bolo‑blog to a version newer than 2.6.4 when it becomes available
  • Implement server‑side input validation or encoding to reject or sanitize malicious script payloads in the articleTitle parameter
  • Deploy an application‑level firewall rule to detect or block suspicious cross‑site scripting payloads on the /console/article/ endpoint
  • Monitor web server logs for anomalous articleTitle values that may indicate exploitation attempts
  • Stay engaged with the bolo‑blog community to receive future security updates and advisories

Generated by OpenCVE AI on March 28, 2026 at 09:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A security flaw has been discovered in bolo-blog 까지 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. A security flaw has been discovered in bolo-blog up to 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Bolo-blog
Bolo-blog bolo-solo
Vendors & Products Bolo-blog
Bolo-blog bolo-solo
Type Values Removed Values Added
Description A security flaw has been discovered in bolo-blog 까지 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title bolo-blog Article Title article cross site scripting
Weaknesses CWE-79
CWE-94
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 7, 2026, 2:49 PM
Reserved
Mar 23, 2026, 5:53 AM

View source JSON

Updated
Mar 26, 2026, 12:26 PM

JSON

Status
Deferred
Published
Mar 24, 2026, 1:17 AM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Mar 29, 2026, 8:28 PM

JSON