CVE-2026-109164

The TDuck survey form through 6.0 is vulnerable to an insecure direct object reference (IDOR) vulnerability. This flaw allows authenticated users to bypass authorization and permanently delete form submissions belonging to other users. By providing their own formKey in the request path and iterat...

EUVD-2026-97370

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the...

EUVD-2026-33422

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or guessed submission ID to formie/submissions/save-submission. This vulnerability is fixed in 2.2.21 and 3.1.26...