PT-2026-99063

CVE-2026-100306

Published

2026-09-25

Updated

2026-09-28

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0

Description The software fails to validate write passwords on submission endpoints, performing the check only on the front end. This allows remote unauthenticated attackers to submit form entries directly to public submission APIs without providing a password by utilizing the form key obtained from share links.

Recommendations Update to a version later than 6.0.

Exploitability

Exploit

Fix

Researchers

Mingsheng Lin

Yaqi Chao

Vendors

Affected products

Weakness enumeration

CWE-602: Client-Side Enforcement of Server-Side Security

Related identifiers