Cross Site Scripting Vulnerability in ttttonyhe OBlog by ttttonyhe
CVE-2026-18968

5.3MEDIUM

Key Information:

Vendor

Ttttonyhe

Status
Oblog
Vendor
CVE Published:
5 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18968?

A cross site scripting vulnerability exists in ttttonyhe OBlog, specifically within the file /tags.php. This flaw arises from improper handling of the argument 'day', allowing for remote attackers to inject malicious scripts into web pages viewed by users. The exploitation of this vulnerability can lead to unauthorized actions and data loss if left unaddressed. Although the vendor was notified about this issue, there has been no response concerning a patch or mitigation. Continuous monitoring and updating of the affected software are advised to ensure security.

Affected Version(s)

OBlog 3ca6a45a2fcc81f6086751d8af124658720e8f8f

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18968 - Proof of Concept

References

https://vuldb.com/vuln/386259
vdb-entrytechnical-description
https://vuldb.com/vuln/386259/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-18968
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hackus_man (VulDB User)
VulDB CNA Team
.