CVE-2026-5468 MEDIUM

CVE-2026-5468: Casdoor dangerouslySetInnerHTML cross site scripting

Vendor N/A
Product Casdoor
Weakness CWE-79 · XSS
Published April 3, 2026
Last update April 3, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

April 3, 2026 CVE published
April 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-66574 TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS) CVE-2023-24398 WordPress EZP Coming Soon Page Plugin <= 1.0.7.3 is vulnerable to Cross Site Scripting (XSS) CVE-2024-51830 WordPress News Ticker plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-34374 WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-4721 Campcodes Complete Web-Based School Management System add_student_subject.php cross site scripting