CVE-2026-90528
Received Received - Intake

Cross-Site Scripting in TDuckApp Tduck-Platform

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90528
EUVD
EUVD-2026-77030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tduckapp tduck-platform to 5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in TDuckApp's tduck-platform up to version 5.3. The flaw exists in the Form Write View component where the submitShowCustomPageContent parameter is manipulated to inject malicious scripts. When an anonymous user submits a public form, the system renders the injected content using Vue's v-html, executing the script in the victim's browser.

Detection Guidance

Check if your TDuckApp instance is running version 5.3 or earlier. Inspect the form write view file at tduck-front/src/views/form/write/index.vue for the submitShowCustomPageContent parameter. Monitor network traffic for POST requests to /user/form/setting/save with malicious payloads in the submitShowCustomPageContent field.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect them to malicious sites. Users interacting with affected forms may have their data compromised or be exposed to phishing attacks. The impact depends on user privileges and data handled by the form.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Organizations using this software must address it to maintain compliance with data protection requirements.

Mitigation Strategies

Upgrade to the latest version of TDuckApp if available. Replace Vue's v-html with text interpolation in the form write view. Implement strict input validation and sanitization for the submitShowCustomPageContent field. Limit field length and restrict content types to prevent script injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart