TTDuckCloud

Products

Exploited and recent CVEs

• CVE-2026-111621 Medium 4.3 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key} 0.3%
• CVE-2026-109167 Medium 4.3 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save 0.2%
• CVE-2026-109165 Medium 4.3 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create 0.2%
• CVE-2026-109164 High 7.1 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey} 0.3%
• CVE-2026-100306 Medium 5.3 TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement 0.4%
• CVE-2026-100305 Medium 4.3 TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint 0.3%
• CVE-2026-100304 Medium 5.3 TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check 0.4%
• CVE-2026-100303 Medium 5.4 TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints 0.3%
• CVE-2026-95829 Medium 6.3 TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection 0.3%
• CVE-2026-92602 High 7.1 TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL 0.4%
• CVE-2026-92567 Medium 6.5 TDuck survey form through 5.0 Unauthorized Data Modification 0.4%
• CVE-2025-8756 Medium 6.3 TDuckCloud tduck-platform manage preHandle improper authorization 0.4%
• CVE-2025-7888 Medium 6.3 TDuckCloud tduck-platform UserFormDataMapper.java UserFormDataMapper sql injection 0.6%
• CVE-2025-0558 Medium 6.3 TDuckCloud tduck-platform QueryProThemeRequest.java QueryProThemeRequest sql injection 0.5%
• CVE-2024-8692 Medium 5.3 TDuckCloud TDuckPro password recovery 0.5%