A vulnerability exists in liangliangyy DjangoBlog where the settings.py file contains hard‑coded database credentials. This flaw allows an attacker capable of influencing the settings handler to overwrite or expose valid user and password values. If successfully exploited, the attacker could gain read or write access to the underlying database, compromising confidentiality and integrity of stored data.

The issue affects versions of liangliangyy DjangoBlog up to 2.1.0.0. No other products or versions are listed as impacted.

The CVSS score of 6.3 indicates a medium severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation so far. The description states that attack may be launched remotely and requires a high level of complexity, implying that successful exploitation would need sophisticated techniques and likely sufficient system access. Despite the moderate scoring, the presence of hard‑coded credentials remains a significant security concern for deployments of the affected DjangoBlog version.