GHSA-w799-7525-rpr6

Source

https://github.com/advisories/GHSA-w799-7525-rpr6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w799-7525-rpr6/GHSA-w799-7525-rpr6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w799-7525-rpr6

Aliases

Published

2026-04-03T15:30:31Z

Modified

2026-06-25T23:11:05Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml

Details

A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T15:36:39Z",
    "nvd_published_at": "2026-04-03T14:16:33Z",
    "severity": "LOW"
}

References

Affected packages

Go / github.com/casdoor/casdoor

Package

Name: github.com/casdoor/casdoor; View open source insights on deps.dev
Purl: pkg:golang/github.com/casdoor/casdoor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.1000.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w799-7525-rpr6/GHSA-w799-7525-rpr6.json"