CVE-2026-5468
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In Casdoor version 2.356.0, the dangerouslySetInnerHTML function is vulnerable to cross-site scripting via manipulation of the formCss, formCssMobile, or formSideHtml arguments. The attack can be launched remotely, and the exploit has been publicly released. The vendor did not respond.
Risk Assessment
The risk is remote execution of scripts in the victim's browser, potentially leading to session theft, defacement, or credential theft.
Recommendation
Immediately disable the dangerouslySetInnerHTML function or apply proper input sanitization, and monitor for vendor updates.
Original NVD description (English source)
A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.