Skip to content
OpenAdvisories

Vendor

ThingsBoard

3 known vulnerabilities.

Products

ThingsBoard 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.9
    CVE-2025-34282 Public exploit

    ThingsBoard < v4.2.1 SVG Image SSRF

    ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way th…

    ThingsBoard ThingsBoard
  • Medium 6.2
    CVE-2025-34281

    Stored Cross-Site Scripting (XSS) in ThingsBoard

    ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting (XSS) vulnerability. The exploit can be triggered when any user accesses the public API endpo…

    ThingsBoard ThingsBoard org.thingsboard:application Maven