CVE-2023-37733

CVE-2023-37733 affects tduck-platform v4.0 and is described in the provided sources as an arbitrary file upload vulnerability that allows attackers to execute arbitrary code via a crafted HTML file. The available connected documents confirm the vendor/platform and vulnerability class but do not p...

CVE-2025-7888

TDuckCloud tduck-platform 5.1 is affected by a SQL injection in the UserFormDataMapper (src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java) driven by manipulation of the formKey argument. The vulnerability is remotely exploitable and has publicly disclosed exploits. Multiple connec...

CVE-2025-0558

CVE-2025-0558 affects TDuckCloud tduck-platform up to 4.0. The vulnerability lies in the function QueryProThemeRequest (src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java), where manipulation of the color parameter enables an SQL injection. Impact as described across sources: re...

CVE-2023-51805

The TDuckCloud tduck-platform v.4.0 software contains a SQL Injection vulnerability (CWE-89) within the FormDataMysqlService.java file. A remote attacker can exploit the getFormKey parameter in the search function to obtain sensitive information. As a temporary workaround, it is recommended to re...

CVE-2025-8756

TDuckCloud TDuck-Platform (versions up to 5.1) contains a vulnerability in the preHandle function of the AuthorizationInterceptor at /manage/ (component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor) that enables improper authorization. A remote attack is possible, and the exploit ...