TDuckCloud vulnerabilities
We track 6 vulnerabilities in TDuckCloud products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest TDuckCloud vulnerabilities
- 7.1 High severity
tduck-survey-form: Authorization Bypass Through User-Controlled Key
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterat
- 7.1 High severity
tduck-survey-form: Server-Side Request Forgery
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal address
- 8.8 High severity
tduck-platform: Incorrect Privilege Assignment
A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The m
- 9.8 Critical severity
tduck-platform: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java. The manipulation of the argument formKey le
- 9.8 Critical severity
tduck-platform: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argu
- 9.8 Critical severity
TDuckPro: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed