CVE-2026-6610: Use of Hard-coded Credentials

A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the component Setting Handler. Such manipulation of the argument USER/PASSWORD leads to hard-coded credentials. The attack may be launched...

CVE-2026-6609: Improper Authorization

A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function formvalid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-6611: Use of Hard-coded Cryptographic Key

A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRETKEY results in use of hard-coded cryptographic key . Remote exploitation o...

CVE-2026-6576: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can lead to command injection. It is...

CVE-2026-6578: Use of Hard-coded Credentials

A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRETKEY results in hard-coded credentials. The attack can be launched remotely. Th...

CVE-2026-6580: Use of Hard-coded Cryptographic Key

A security vulnerability has been detected in liangliangyy DjangoBlog up to 2.1.0.0. Affected is an unknown function of the file owntracks/views.py of the component Amap API Call Handler. Such manipulation of the argument key leads to use of hard-coded cryptographic key . The attack may be launch...

CVE-2026-6579: Missing Authentication for Critical Function

A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the...

CVE-2026-6577: Missing Authentication for Critical Function

A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the component logtracks Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly...

CVE-2023-2954

Cross-site Scripting XSS - Stored in GitHub repository liangliangyy/djangoblog prior to master...

CVE-2023-2954 Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog

Cross-site Scripting XSS - Stored in GitHub repository liangliangyy/djangoblog prior to master...

CVE-2023-2954: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository liangliangyy/djangoblog prior to master...

CVE-2023-2954 Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog

Cross-site Scripting XSS - Stored in GitHub repository liangliangyy/djangoblog prior to master...

CVE-2023-2954

Cross-site Scripting XSS - Stored in GitHub repository liangliangyy/djangoblog prior to master...

CVE-2023-2954

CVE-2023-2954 is a stored XSS in the DjangoBlog project liangliangyy/djangoblog prior to master. Connected sources confirm the vulnerability arises from handling Markdown comments, enabling script execution when users view or interact with comments. PoCs and documented payloads exist (Huntr, etc....