CVE-2026-6610
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0 in an unknown function of the djangoblog/settings.py file, related to settings handling. Manipulation of the USER/PASSWORD arguments leads to hard-coded credentials. The attack can be launched remotely but requires a high level of complexity. The exploit has been publicly disclosed, and the vendor did not respond.
Risk Assessment
Hard-coded credentials could be used by an attacker to gain unauthorized access to the system or database. Since the exploit is public, the risk of exploitation increases despite the high attack complexity.
Recommendation
Upgrade DjangoBlog to the latest version if a fix is available, or remove hard-coded credentials and replace them with a secure secret management mechanism. Monitor logs for unauthorized access.
Other vulnerabilities in DjangoBlog
See all- CVE-2026-6611Low
A vulnerability was found in liangliangyy DjangoBlog up to version 2.1.0.0 involving a hard-coded cryptographic key in djangoblog/settings.py within the File Upload Endpoint component. Manipulating the SECRET_KEY argument results in use of a hard-coded key. Remote exploitation is possible but rated as high complexity and difficult exploitability.
- CVE-2026-6609Medium
A flaw was found in liangliangyy DjangoBlog up to 2.1.0.0 affecting the form_valid function in oauth/views.py. Manipulating the oauthid argument causes improper authorization, and the attack may be initiated remotely. The exploit has been published.
- CVE-2026-6579Medium
A weakness was identified in liangliangyy DjangoBlog up to 2.1.0.0 affecting an unknown function in blog/views.py of the Clean Endpoint component, causing missing authentication. The attack may be initiated remotely, and a public exploit could be used. The vendor was contacted but did not respond.
- CVE-2026-6578Medium
A security flaw was discovered in DjangoBlog up to version 2.1.0.0 affecting djangoblog/settings.py, where a hard-coded SECRET_KEY is used. The attack can be launched remotely but requires high complexity. The exploit has been publicly released and the vendor did not respond.
- CVE-2026-6576Medium
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0 in the CommandHandler function of servermanager/api/commonapi.py within the WeChat Bot Interface component. Manipulation of the Source argument leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor was contacted but did not respond.
Original NVD description (English source)
A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/settings.py of the component Setting Handler. Such manipulation of the argument USER/PASSWORD leads to hard-coded credentials. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS