CVE-2026-100305
TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/creat
CVSS
4.3
Medio
EPSS
0.3%
p19
KEV
—
Exploit Today
6
0-100
Publicado: 25 sept 2026 · Última mod.: 28 sept 2026 · CWE-862
0.3%EPSS · 30 días0.3%
2026-09-262026-10-25
TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results.
- github.comhttps://github.com/LinYuanyi1/cve-request-poc/blob/adffc39b78cad18cd489cbf7454853bf0f744b7f/tduck/poc_form_data_create_bypass.py
- github.comhttps://github.com/TDuckCloud/tduck-survey-form
- github.comhttps://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormResultController.java#L135-L172
- github.comhttps://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-form/src/main/java/com/tduck/cloud/form/service/impl/UserFormSettingServiceImpl.java#L77-L135
- www.vulncheck.comhttps://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-fill-in-restriction-bypass-via-authenticated-submission-endpoint
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1159725.3 MED19.8%
——6A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.1dCVE-2026-1141926.5 MED12.3%
——4Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.1dCVE-2026-1141917.5 ALT26.7%
——8Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.1dCVE-2026-1160084.3 MED9.2%
——3DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.1dCVE-2026-1147056.5 MED12.9%
——4Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.1dCVE-2026-1159757.1 ALT11.8%
——4Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects1d