CVE-2026-92602 — TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to othe…
Published: 2026-09-16 · CVSS: 7.1 · CVSS 4.0
TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7