EUVD-2026-87293

TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP...

CVE-2026-100305

The TDuck survey form (versions through 6.0) contains a vulnerability where the authenticated submission endpoint POST /user/form/data/create fails to enforce form fill-in restrictions. Authenticated attackers who possess a form's key can submit unlimited entries to any form. This bypasses critic...

CVE-2026-100305: Missing Authorization

TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP...