{"id":"CVE-2026-95829","summary":"TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection","details":"A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.","modified":"2026-09-24T08:26:15.294970Z","published":"2026-09-22T23:15:10.573Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95829.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95829.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95829"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-95829"},{"type":"ADVISORY","url":"https://vuldb.com/submit/897248"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/408522"},{"type":"REPORT","url":"https://vuldb.com/vuln/408522/cti"},{"type":"FIX","url":"https://github.com/TDuckCloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tduckcloud/tduck-survey-form","events":[{"introduced":"53a5dfbc659ff9a6b979274d23e7a838198230fb"},{"fixed":"ea7f0fae7cb0fd998a3284c11addce689350cd69"}],"database_specific":{"extracted_events":[{"introduced":"5.0"},{"last_affected":"5.0"},{"introduced":"5.1"},{"last_affected":"5.1"},{"introduced":"5.2"},{"last_affected":"5.2"},{"introduced":"5.3"},{"last_affected":"5.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.0","5.1","5.2","5.3","Tduckx","v5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95829.json","vanir_signatures_modified":"2026-09-24T08:26:15Z","vanir_signatures":[{"id":"CVE-2026-95829-050665c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"function":"addDateTimeRange","file":"tduck-common/src/main/java/com/tduck/cloud/common/util/QueryWrapperUtils.java"},"deprecated":false,"digest":{"function_hash":"314383559336739246323104292239016088012","length":505}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserManageController.java","function":"queryPage"},"deprecated":false,"digest":{"function_hash":"260144942082706805550070196215689130062","length":264},"id":"CVE-2026-95829-10b857b4","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["141169979920796121230942298943441119394","291395241814957028218999951982012748777","61528224693167997234494223483734386333","316740941731415686836978707724571520378","94311682841144556952198558662081645393","287509038480039889293267862299420290699","303728401590583942366952765576494080189","240955262350538794328416354842178045272","256549412732310851707483715812154406814"],"threshold":0.9},"id":"CVE-2026-95829-14015cb8","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormTemplateController.java"}},{"deprecated":false,"digest":{"line_hashes":["17441742197447205053720686106787431373","123188344505022398971549729791957527493","217813587377213145384617008059379631491","111537938086627963587153534962201041735","228427591410293005170963522125076733596","69132103460647265958436094283231186983","264360428880535424770005107932758280941","113190916163909773936689194686738120004","221249513150833729045799110022432343961","115178942411336234933360736366416943100","267633229863409499660680366731439574934","123602062687927440640688575083776007068","82642629599948406983005265057704937051","15703153444694135510632807008340202726","183147452788461504682855330542693188579","144743494053280400592180406391248450790"],"threshold":0.9},"id":"CVE-2026-95829-7f4d52b2","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-common/src/main/java/com/tduck/cloud/common/util/QueryWrapperUtils.java"}},{"deprecated":false,"digest":{"function_hash":"315306497146741159408906651848231736177","length":163},"id":"CVE-2026-95829-9316483f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java","function":"queryPage"}},{"deprecated":false,"digest":{"line_hashes":["220757356936937295175505480255652339083","283534176741839933582689237758980417615","228069916748905813888005581664546642579","330920592309438270543091247739964070273","295380118771787923116060896320206553067","71234274038684254148180905760063520922","72920373588353151859620052925548250141","229001373692831932520947435596652490275","139594666671233358330992559052845228854","38337253068727364555965914656369527238","205341809461494826779702104689099875246","28012541506135648531613773592270549343","170640884495977224502081388854384102218"],"threshold":0.9},"id":"CVE-2026-95829-98c3d3a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/SyncDataController.java"}},{"digest":{"length":403,"function_hash":"84577868002195059526885890495279750691"},"id":"CVE-2026-95829-a0efdad5","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-common/src/main/java/com/tduck/cloud/common/util/QueryWrapperUtils.java","function":"handleSortColumn"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormThemeController.java"},"deprecated":false,"digest":{"line_hashes":["45974652466282765244027387679582797525","143169480734346125413109276902698877710","328860939155130185349317721117787801644","327536600600454915953543126620582138345","108556771426100597095891638588133221168","234030207422431998533636824307532732377","139575023323406778550253712268557539710","21876938266539497688860068689282236594","137861233349179909631554239919372037734"],"threshold":0.9},"id":"CVE-2026-95829-bb913d88"},{"id":"CVE-2026-95829-cf1a0f26","signature_type":"Function","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/FormTemplateController.java","function":"queryCategoryPage"},"deprecated":false,"digest":{"function_hash":"196757937934638099156351919120142759406","length":174}},{"signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/SyncDataController.java","function":"getFormData"},"deprecated":false,"digest":{"function_hash":"2168813154850583380181680341144271766","length":388},"id":"CVE-2026-95829-ea62d784","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tduckcloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","target":{"file":"tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserManageController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["307825943343805725004976707913516758918","138321819108821659405522165090299400288","28874033786236860493197993229564698403","253737704157707300447145398072406866510","266862330533814933291738278101320170463","169128846365908173846210495522532222344","258863992020544859748733693396844735460","169630928007202674467458613923762905221","127470424432169315411369321443190168665","51742291098379579433350263388302807553","140765430976884900450944428116632466933","222462093294059563425928302367555837618"]},"id":"CVE-2026-95829-fd1ce7b0"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}