CVE-2026-109165 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-109164 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the...

CVE-2026-109165 TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-109165: Authorization Bypass Through User-Controlled Key

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646: Exposure of Sensitive Information to an Unauthorized Actor

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2025-7888: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java. The manipulation of the argument formKey leads to sql injection. The attack may ...

TDuckCloud tduck-platform injection vulnerability

TDuckCloud tduck-platform is an open source form survey system from China's Zhongda Numerical Wei TDuckCloud company. An injection vulnerability exists in TDuckCloud tduck-platform version 5.1, which stems from incorrect manipulation of the formKey parameter of the function UserFormDataMapper in...

Cross-site Request Forgery (CSRF)

openmage/magento-lts is vulnerable to cross-site request forgery. The vulnerability exists because of lack of formkey protection in the function validateSecretKey of Admin Interface, allowing an attacker to easily observe timing discrepancy in OpenMage LTS...

Observable Timing Discrepancy in OpenMage LTS

Impact This vulnerability allows to circumvent the formkey protection in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks Patches The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved References Related to Adobes CVE-2020-9690...

GHSA-CRF2-XM6X-46P6 Observable Timing Discrepancy in OpenMage LTS

Impact This vulnerability allows to circumvent the formkey protection in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks Patches The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved References Related to Adobes CVE-2020-9690...

CVE-2002-0292: Undefined Security Weakness

Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field...