CVE-2024-41658

Casdoor CVE-2024-41658 involves a reflected XSS in the QrCodePage.js flow used when generating WeChat Pay QR codes. The issue arises in Casdoor 1.577.0 and earlier, where the payment page displays a QR code linked to a wechatpay URL and takes a query parameter from the successUrl, then redirects ...