2 matches found
Sql injection
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...
6.5CVSS8.8AI score0.01049EPSS
SaveExploits1References2Affected Software1
CVE-2023-45303: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute for content sent to the /api/admin/settings endpoint...
8.8CVSS7.3AI score0.01049EPSS
SaveExploits1References3
20