Diaowen vulnerabilities
Published CVEs affecting Diaowen products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-18723
Medium · 6.3
CWE-266 Aug 4, 2026
diaowen DWSurvey Survey Status up-survey-status.do improper authorization
A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-18722
Medium · 6.3
CWE-285 Aug 4, 2026
diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-63248
High · 7.5
CWE-639 Nov 5, 2025
Authorization Bypass Through User-Controlled Key (IDOR) in Diaowen Dwsurvey
DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire can enable the deletion of other questionnaires.