Threats tagged 'ghsa-qhjv-j3c3-593v'

SurveyKing version 1.13.2 has a missing authorization vulnerability in its result lookup feature. The anonymous survey view leaks the lookup configuration, including the password. Additionally, the lookup password check is bypassed when no answer is provided. This allows unauthenticated attackers with access to a public survey link to inject a wildcard character into the query, enabling them to retrieve all survey responses, including hidden fields.