PT-2026-99063 · Tduck · Tduck
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
TDuck survey form versions prior to 6.0
Description
The software fails to validate write passwords on submission endpoints, performing the check only on the front end. This allows remote unauthenticated attackers to submit form entries directly to public submission APIs without providing a password by utilizing the form key obtained from share links.
Recommendations
Update to a version later than 6.0.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tduck