Vendor
liangliangyy
11 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
Medium 5.1
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter commen…
-
Medium 5.4
DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payloa…
-
Medium 6.3
liangliangyy DjangoBlog views.py form_valid improper authorization
A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiated remotely. The expl…
-
Medium 6.5
liangliangyy DjangoBlog Clean Endpoint views.py missing authentication
A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. This impacts an unknown function of the file blog/views.py of the component Clean Endpoint. This manipulation causes missing authentication. The attack may be initiated remotely. The exp…
-
Medium 5.6
liangliangyy DjangoBlog Setting settings.py hard-coded credentials
A security flaw has been discovered in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component Setting Handler. The manipulation of the argument SECRET_KEY results in hard-coded credentials. …
-
Medium 6.3
liangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injection
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can …
-
Medium 4.8
Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.