Tduckcloud Tduck-Platform vulnerabilities

CVE-2025-7888 [CRITICAL] CWE-74 CVE-2025-7888: A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue af A vulnerability was found in TDuckCloud tduck-platform 5.1 and classified as critical. This issue affects the function UserFormDataMapper of the file src/main/java/com/tduck/cloud/form/mapper/UserFormDataMapper.java. The manipulation of the argument formKey leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed t

CVE-2025-8756 [HIGH] CWE-266 CVE-2025-8756: A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Af A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit h

CVE-2025-0558 [CRITICAL] CWE-74 CVE-2025-0558: A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulner A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the file src/main/java/com/tduck/cloud/form/request/QueryProThemeRequest.java. The manipulation of the argument color leads to sql injection. The attack can be initiated remotely. The exploit has bee

CVE-2023-51805 [MEDIUM] CWE-89 CVE-2023-51805: SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain se SQL Injection vulnerability in TDuckCLoud tduck-platform v.4.0 allows a remote attacker to obtain sensitive information via the getFormKey parameter in the search function of FormDataMysqlService.java file.

CVE-2023-37733 [MEDIUM] CWE-79 CVE-2023-37733: An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.