EUVD-2026-45424
GHSA-rvxx-mcx2-w53p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to read cleartext passwords from storage; impact is limited to low confidentiality of entry passwords with no integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at zinnia/views/mixins/entry_protection.py, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Technical ContextAI
django-blog-zinnia is a Django (Python) blog application identified by CPE cpe:2.3:a:fantomas42:django-blog-zinnia:*:*:*:*:*:*:*:*. Its entry protection feature allows blog authors to restrict individual posts behind a password, implemented in the mixin at zinnia/views/mixins/entry_protection.py. CWE-312 (Cleartext Storage of Sensitive Information) is the root cause class: the application stores submitted entry-protection passwords in a readable form - most likely directly in the Django ORM-backed database - rather than applying a one-way hash. This means any principal with SELECT privileges on the relevant database table, or with filesystem access to a database dump or export, can recover those passwords without any cryptographic attack.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the vulnerability report filed via GitHub issue 595, and the project shows signs of being unmaintained. Organizations relying on this package should evaluate migrating to an actively maintained Django blogging solution as the primary remediation path. As compensating controls: restrict database access so only the Django application service account can read the entry-protection tables, reducing the population of actors who could retrieve the cleartext values (trade-off: operational overhead of tighter DB ACLs). Alternatively, disable the Protected Entry Password Handler feature entirely and use Django's built-in authentication and permission system to gate access to sensitive posts - this eliminates the exposure but removes the password-per-entry UX. A third option is to override the entry_protection.py mixin in a local fork to hash submitted passwords using Django's make_password utility before storage; this requires ongoing maintenance of a local patch. Canonical references: https://vuldb.com/vuln/380029 and https://github.com/Fantomas42/django-blog-zinnia/issues/595.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today