CVE-2026-90528

TDuckApp tduck-platform Form Write View index.vue cross site scripting

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability resides in the Form Write View component of TDuckApp tduck-platform, specifically the submitShowCustomPageContent argument in the index.vue file. An attacker can supply crafted content that is interpreted as JavaScript, leading to a stored or reflected cross‑site scripting flaw. The injected code executes within the victim’s browser context, enabling attackers to steal session cookies, deface content, or perform further malicious actions. The weakness is catalogued as CWE‑79 and CWE‑94, indicating unchecked code injection and potential for arbitrary script execution.

Affected Systems

TDuckApp tduck-platform versions through 5.3 are affected. Any deployment running these releases is vulnerable, and the vendor has not yet released a patch or advisory to address the flaw.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low but non‑zero chance of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation can be achieved remotely by sending a specially crafted request to the application without requiring any elevated privileges, making it easily reachable for attackers.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor’s website or repository for an updated release or advisory that addresses the XSS flaw; upgrade to a patched version when available.
  • Implement strict input validation and output encoding for the submitShowCustomPageContent field to ensure any user‑supplied content is treated as data rather than executable code.
  • Continuously scan the application for XSS vulnerabilities and audit user‑generated content, remediating any discovered issues promptly.

Generated by OpenCVE AI on September 15, 2026 at 16:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title TDuckApp tduck-platform Form Write View index.vue cross site scripting
First Time appeared Tduckapp
Tduckapp tduck-platform
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:tduckapp:tduck-platform:*:*:*:*:*:*:*:*
Vendors & Products Tduckapp
Tduckapp tduck-platform
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 3:28 PM
Reserved
Sep 12, 2026, 11:03 AM

View source JSON

Updated
Sep 14, 2026, 3:28 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 3:16 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:45 PM

JSON