Rating:
(Written in Simplified Chinese) Self-xss + Django open redirect + broken auth system.
I don't remember