CVE-2023-37733

CVE-2023-37733 affects tduck-platform v4.0 and is described in the provided sources as an arbitrary file upload vulnerability that allows attackers to execute arbitrary code via a crafted HTML file. The available connected documents confirm the vendor/platform and vulnerability class but do not p...

CVE-2025-0558

CVE-2025-0558 affects TDuckCloud tduck-platform up to 4.0. The vulnerability lies in the function QueryProThemeRequest (src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java), where manipulation of the color parameter enables an SQL injection. Impact as described across sources: re...

CVE-2023-51805

The CVE-2023-51805 entry maps to TDuckCloud tduck-platform v4.0, where the vulnerability is a SQL Injection in the getFormKey parameter used by the search function in FormDataMysqlService.java. Source documents consistently indicate this affects TDuckCLoud tduck-platform 4.0 and can expose sensit...

CVE-2025-7888

TDuckCloud tduck-platform 5.1 is affected by a SQL injection in the UserFormDataMapper (src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java) driven by manipulation of the formKey argument. The vulnerability is remotely exploitable and has publicly disclosed exploits. Multiple connec...

CVE-2025-8756

TDuckCloud TDuck-Platform (versions up to 5.1) contains a vulnerability in the preHandle function of the AuthorizationInterceptor at /manage/ (component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor) that enables improper authorization. A remote attack is possible, and the exploit ...