Vulnerabilities

TI-2025-24420 CVE-2025-34282 · GHSA-c4r5-r62q-8988

ThingsBoard < v4.2.1 SVG Image SSRF

MEDIUM 40

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01818 Published 2025-10-17 Fixed in 4.2.1 CWE-918

TI-2025-24419 CVE-2025-34281 · GHSA-fpq4-r87v-g246

Stored Cross-Site Scripting (XSS) in ThingsBoard

LOW 28

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability.

CVSS 4.0MEDIUM 6.2 Network Low privileges User interaction EPSS 0.00387 Published 2025-10-17 Fixed in 4.2.1 CWE-79

TI-2025-08336 CVE-2025-9094 · GHSA-f339-r2mr-9cr3

ThingsBoard Add Gateway special elements used in a template engine

LOW 24

A vulnerability was detected in ThingsBoard 4.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0033 Published 2025-08-17 No fix listed CWE-1336

TI-2024-36843 CVE-2024-55466 · GHSA-2qg3-px2c-m64g

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community…

LOW 31

An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard Professional v3.8.1 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00391 Published 2025-05-12 No fix listed CWE-77

TI-2024-08682 CVE-2024-9358 · GHSA-wgr5-rw77-5f6p

ThingsBoard HTTP RPC API resource consumption

LOW 28

A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00792 Published 2024-10-01 No fix listed CWE-400

TI-2024-03067 CVE-2024-3270 · GHSA-grww-gcmh-xr44

ThingsBoard AdvancedFeature access control

LOW 32

A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00576 Published 2024-04-03 No fix listed CWE-284

TI-2023-24282 CVE-2023-45303 · GHSA-6pgr-j9v4-xfvv

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to…

HIGH 73

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/se…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01049 Published 2023-10-06 Fixed in 3.5 CWE-74

TI-2022-22507 CVE-2022-45608 · GHSA-86xc-fp29-26g2

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers…

MEDIUM 42

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administrator (TENANT_ADMIN) or (SYS_ADMIN) on the web application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00864 Published 2023-03-01 No fix listed CWE-269

TI-2023-11609 CVE-2023-26462 · GHSA-pvpx-gxvp-44wq

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because…

MEDIUM 40

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01129 Published 2023-02-23 No fix listed CWE-798

TI-2022-23955 CVE-2022-48341 · GHSA-c8gv-h2p7-9j69

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical…

MEDIUM 42

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00986 Published 2023-02-23 No fix listed CWE-269

TI-2022-18942 CVE-2022-40004 · GHSA-wrvg-r9g6-49j5

Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to…

MEDIUM 45

Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0094 Published 2022-12-15 No fix listed CWE-79

TI-2022-13715 CVE-2022-31861 · GHSA-3g8p-46fx-xh9m

Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.

LOW 25

Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0065 Published 2022-09-13 No fix listed CWE-79

TI-2021-18955 CVE-2021-42751 · GHSA-cm2p-96gm-hwf2

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows…

LOW 28

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.03207 Published 2022-08-12 No fix listed CWE-79

TI-2021-18954 CVE-2021-42750 · GHSA-2fvg-6m83-pjw6

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows…

LOW 28

A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.03207 Published 2022-08-12 No fix listed CWE-79

TI-2020-16789 CVE-2020-27687 · GHSA-gxgw-6q4v-hcj8

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails.

MEDIUM 41

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01539 Published 2020-12-18 No fix listed CWE-20

Vulnerabilities

Filters