Tduckcloud Tduck-Survey-Form
10 CVEs affecting Tduckcloud Tduck-Survey-Form. Latest disclosed: 2026-10-16. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-109164 | High | 7.1 | 2026-10-12 | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submission… |
CVE-2026-92602 | High | 7.1 | 2026-09-16 | TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attac… |
CVE-2026-92567 | Medium | 6.5 | 2026-09-16 | TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated user… |
CVE-2026-100303 | Medium | 5.4 | 2026-09-25 | TDuck survey form through 6.0 lacks authorization checks on FormThemeController write endpoints for global form themes and categories. Authenticated non-admin… |
CVE-2026-100306 | Medium | 5.3 | 2026-09-25 | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated atta… |
CVE-2026-100304 | Medium | 5.3 | 2026-09-25 | TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing auth… |
CVE-2026-111621 | Medium | 4.3 | 2026-10-16 | TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET… |
CVE-2026-109167 | Medium | 4.3 | 2026-10-12 | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwr… |
CVE-2026-109165 | Medium | 4.3 | 2026-10-12 | TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user… |
CVE-2026-100305 | Medium | 4.3 | 2026-09-25 | TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated at… |