Threats affecting pkg:github/casdoor/casdoor

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.2%	CVE-2026-108572Casdoor · Server-Side Request Forgery Medium5.3EPSS 0.2%2026-10-11CVE Database V5CVE-2026-108572 CVE-2026-108572 is a server-side request forgery (SSRF) vulnerability in Casdoor affecting versions 3.164.0 and 4.0 through 4.10.0. The vulnerability exists in the CasP3ProxyValidate function within the controllers/cas.go file, where manipulation of the pgtUrl argument can lead to SSRF. The issue can be exploited remotely. A public exploit disclosure exists. Upgrading to version 4.11.0 addresses this vulnerability. EPSS 0.2%Vulnerability	CVE Database V5	2026-10-11
High	7.5	EPSS 0.5%	CVE-2024-41264casdoor · Information Exposure High7.5EPSS 0.5%2024-08-01CVE Database V5CVE-2024-41264 An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. EPSS 0.5%Vulnerability CWE-200	CVE Database V5	2024-08-01

Page 1 of 1