The ttttonyhe OBlog software contains a cross-site scripting (CWE-79) vulnerability in the processing of the 'day' parameter in the /tags.php file. This vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser. Exploitation requires remote access and user interaction. The product uses a rolling release model, and no specific affected or fixed versions are provided. The vendor did not respond to the vulnerability disclosure. The CVSS 3.1 base score is 4.3, reflecting low severity with network attack vector, low complexity, no privileges required, and user interaction needed.

Successful exploitation results in cross-site scripting, which can lead to limited impact such as injection of malicious scripts in the victim's browser session. There is no confidentiality or availability impact reported. The vulnerability requires user interaction and can be triggered remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect or block suspicious input to the 'day' parameter in /tags.php to mitigate exploitation risk.