Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

TDuckCloud tduck-platform allows remote SQL injection via pagination

CVE-2026-95829 · published 26 days ago
Summary

The TDuckCloud tduck-platform up to version 5.3 lets an attacker inject malicious database commands when it processes certain pagination settings. This can be triggered from outside the system and may lead to data theft or alteration. Apply the provided software patch as soon as possible to stop the problem.

Original advisory text
TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-95829 · NVD
CVE-2026-95829 · OSV
Track software like this
Free during beta