Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the GetSession function. An attacker can access sensitive SSH session data belonging to other tenants by providing a valid session UID and authenticating with any user account...

SQL Injection

github.com/casdoor/casdoor is vulnerable to sql injection. An attacker can inject and execute malicious input through the GetSession function of adapter.go as it does not properly filter the user input field and value parameters...