The vulnerability permits an attacker to inject malicious script through the articleTitle parameter in the /console/article/ endpoint. The Article Title Handler processes the input without proper sanitization, leading to client‑side script execution. The flaw corresponds to CWE‑79 and indicates misuse of code evaluation mechanisms (CWE‑94). Remote exploitation is possible by sending a crafted HTTP request containing malicious JavaScript.

The flaw affects bolo‑blog versions up to 2.6.4. No other vendors or products are listed. The affected component is the Article Title Handler in the /console/article/ path of the bolo‑blog platform.

The CVSS base score of 4.8 points to moderate severity, while the EPSS score of less than 1% implies a low probability of widespread exploitation at present. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Exploitation can be performed by an attacker who sends a malformed articleTitle value to the exposed endpoint, and the resulting cross‑site scripting can be leveraged to execute arbitrary JavaScript in the victim’s browser.