This vulnerability in ttttonyhe OBlog involves improper processing of the 'day' parameter in the /tags.php file, leading to cross-site scripting (XSS). An attacker can remotely exploit this flaw by injecting malicious scripts that execute in the context of a victim's browser. The software uses a rolling release model, and no specific affected or fixed versions are identified. The vendor has not provided any response or patch information. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and limited impact on integrity and availability.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers when they visit the vulnerable page. This can result in session hijacking, defacement, or other client-side impacts. There is no indication of impact on confidentiality, integrity, or availability beyond the XSS context. No active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the 'day' parameter if possible. Monitor for vendor updates or community patches due to the rolling release nature of the product.