EUVD-2026-23783
GHSA-gccw-6jq7-5553
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the component Setting Handler. Such manipulation of the argument USER/PASSWORD leads to hard-coded credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in djangoblog/settings.py that can be exploited remotely to bypass authentication and gain unauthorized access. The vulnerability stems from sensitive USER/PASSWORD arguments being embedded in configuration files, allowing attackers with network access to retrieve database credentials. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Technical ContextAI
DjangoBlog is a Django-based blogging application where sensitive database credentials are hard-coded in the settings.py configuration file rather than being externalized via environment variables or secure credential stores. The Setting Handler component processes USER/PASSWORD arguments without proper sanitization or protection. CWE-798 (Use of Hard-Coded Credentials) classifies this as a credential storage vulnerability where authentication material is stored in plaintext within application source code or configuration. This is compounded by the fact that settings.py is typically accessible through version control systems, backups, or misconfigured web server routes exposing source directories. The vulnerability affects all versions of DjangoBlog through 2.1.0.0 as identified by the CPE string cpe:2.3:a:liangliangyy:djangoblog:*:*:*:*:*:*:*:*.
RemediationAI
Immediate action requires identifying and updating any hard-coded USER/PASSWORD values in djangoblog/settings.py to use environment variables or a secure secrets management system (e.g., Python-dotenv, HashiCorp Vault, AWS Secrets Manager). Do not use placeholder or default credentials; generate strong, unique database credentials and ensure the updated settings.py file is excluded from version control using .gitignore. If running DjangoBlog 2.1.0.0 or earlier, upgrade to a version released after this disclosure if available, or consider migrating to an actively maintained blogging platform. As an interim compensating control, restrict network access to the Django application and database using firewall rules and VPCs-limit database connectivity to only the application server. Additionally, audit all version control repositories, backups, and web-accessible directories for exposed djangoblog/settings.py files and immediately rotate all database credentials. Review database access logs for unauthorized queries that may indicate prior exploitation. Given that the vendor has not responded to disclosure, do not expect a patch and prioritize remediation or retirement of the application.
More in Djangoblog
View allDjangoBlog up to version 2.1.0.0 contains an authentication bypass vulnerability in the blog/views.py Clean Endpoint tha
Missing authentication in DjangoBlog 2.1.0.0 and prior allows remote unauthenticated attackers to inject GPS tracking da
Hard-coded Amap API key exposure in DjangoBlog allows remote attackers to abuse geolocation services without authenticat
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master. Rated medium severity
Liangliangyy DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in the SECRET_KEY parameter within djangob
Command injection in DjangoBlog WeChat Bot Interface allows authenticated remote attackers to execute arbitrary system c
Improper authorization in liangliangyy DjangoBlog versions up to 2.1.0.0 allows authenticated remote attackers to manipu
DjangoBlog versions up to 2.1.0.0 use a hard-coded cryptographic key in djangoblog/settings.py when the SECRET_KEY argum
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today