CVE-2026-62849

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-62849 ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-62849

The enterprise IoT platform ThingLinks contains an unauthenticated SQL injection vulnerability in the TDengine TDS APIs prior to version 1.4.0 . The flaw exists because request-controlled JSON field values submitted to the /anyUser/tds/insertTableData endpoint reach unsafe SQL construction within...

EUVD-2026-114457

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-62853

The enterprise IoT platform ThingLinks is vulnerable to authenticated remote code execution (RCE) in versions prior to 1.4.0 . The vulnerability exists within the rule engine 's Groovy script test/register flow, where the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy scri...