tduck-survey-form vulnerabilities

2 known vulnerabilities in tduck-survey-form from TDuckCloud. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  tduck-survey-form: Authorization Bypass Through User-Controlled Key

  CVE-2026-109164Oct 12, 2026TDuckCloud

  TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterat

• 7.1 High severity

  tduck-survey-form: Server-Side Request Forgery

  CVE-2026-92602Sep 16, 2026TDuckCloud

  TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal address