This vulnerability affects bolo-blog versions 2.6.0 through 2.6.4. It arises from improper handling of the articleTitle parameter in the /console/article/ component, allowing an attacker to inject malicious scripts via cross-site scripting. The attack vector is network-based with low attack complexity but requires privileges and user interaction. The vulnerability has been publicly disclosed, but no official fix or patch is currently available from the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the attack requires user interaction and some privileges, which limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should consider applying temporary mitigations such as input validation and output encoding on the articleTitle parameter to prevent script injection. Monitoring for updates from the vendor is recommended.