tduck-platform vulnerabilities
3 known CVE vulnerabilities in tduck-platform, translated and rated.
- CVE-2026-95829Medium
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. It affects the PaginationInnerInterceptor.concatOrderBy function in MybatisPlusConfig.java, where manipulation of the orders[0].column argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.
- CVE-2026-90528Low
A flaw was found in TDuckApp tduck-platform up to version 5.3. It affects an unknown functionality in tduck-front/src/views/form/write/index.vue of the Form Write View component, where manipulation of the submitShowCustomPageContent argument causes cross site scripting (XSS). The attack can be carried out remotely, and the project was informed early via an issue report but has not responded.
- CVE-2023-37733Medium
An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.