GCVE - cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:diaowen:dwsurvey:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Diaowen (`fef732d2-c475-5631-9676-2d22a4d6de5d`)
Product	Dwsurvey (`45c0c3a5-2e3d-599c-b1a2-fa3e380b683e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:docker/wkeyuan/dwsurvey`	purl2cpe	2026-06-01 10:16:12.983717
`pkg:github/wkeyuan/dwsurvey`	purl2cpe	2026-06-01 10:16:12.983720

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-18722`	vulnerable	2026-09-16 04:34:01.881331	diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization MEDIUM (6.3) A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2026-08-04T03:00:08.926Z Updated: 2026-08-04T14:20:14.881Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/385633 https://vuldb.com/vuln/385633/cti https://vuldb.com/cve/CVE-2026-18722 https://vuldb.com/submit/856183 https://drive.google.com/file/d/1S4_tO4YGk4schmB7AIZa3dq3wGxgfN8T/view?usp=sharing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-18723`	vulnerable	2026-09-16 04:34:01.593208	diaowen DWSurvey Survey Status up-survey-status.do improper authorization MEDIUM (6.3) A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2026-08-04T03:15:07.565Z Updated: 2026-08-04T15:03:22.366Z Open on db.gcve.eu Reference links https://vuldb.com/vuln/385634 https://vuldb.com/vuln/385634/cti https://vuldb.com/cve/CVE-2026-18723 https://vuldb.com/submit/856184 https://drive.google.com/file/d/1Ziv1My5IHNnEobdHOwCfx7d6eHUs-gnS/view?usp=sharing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-40980`	vulnerable	2026-06-08 06:11:04.787223	Details available File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file. Published: 2023-09-01T00:00:00.000Z Updated: 2024-09-30T20:26:54.937Z Open on db.gcve.eu Reference links https://github.com/wkeyuan/DWSurvey/issues/107	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-15095`	vulnerable	2026-06-08 05:12:56.659525	Details available DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter. Published: 2019-08-16T00:28:29.000Z Updated: 2024-08-05T00:34:53.276Z Open on db.gcve.eu Reference links https://github.com/wkeyuan/DWSurvey/issues/48	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-14747`	vulnerable	2026-06-08 05:12:55.971043	Details available DWSurvey through 2019-07-22 has stored XSS via the design/my-survey-design!copySurvey.action surveyName parameter. Published: 2019-08-07T15:12:32.000Z Updated: 2024-08-05T00:26:38.598Z Open on db.gcve.eu Reference links https://github.com/wkeyuan/DWSurvey/issues/47	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Dwsurvey

Notes

PURL mappings

Vulnerability references

Contribute