CVE-2026-90528
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.
Risk Assessment
This XSS vulnerability in the form view may allow an attacker to execute malicious script in a user's browser, risking data or session theft. The project's lack of response to the report increases the risk of the system remaining unpatched.
Recommendation
Update tduck-platform to a version later than 5.3 if a fix is available, or apply configuration-side mitigations. Monitor vendor communications and consider limiting the application's internet exposure.
Other vulnerabilities in tduck-platform
See all- CVE-2026-95829Medium
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. It affects the PaginationInnerInterceptor.concatOrderBy function in MybatisPlusConfig.java, where manipulation of the orders[0].column argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.
- CVE-2023-37733Medium
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
Original NVD description (English source)
A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.