CVE-2025-3261

...

CVE-2025-3261

...

编号撤回

ThingsBoard is a Java-based platform for IOT devices for monitoring, management, and data collection by the ThingsBoard team. A security vulnerability exists in ThingsBoard versions prior to 4.2.1, which stems from Image Gallery allowing the uploading of malicious SVG images, which could lead to ...

CVE-2025-61795 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-HGRR-935X-PQ79 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, cassandra-reaper, dependency-track, akhq, kserve-modelmesh, trino, nextflow, zookeeper, apache-nifi, apache-nifi-registry, thingsboard...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, cassandra-reaper, dependency-track, akhq, kserve-modelmesh, trino, nextflow, zookeeper, apache-nifi, apache-nifi-registry, thingsboard...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-nifi, kayenta-fips, kserve-modelmesh, cassandra-fips, keycloak-config-cli, ontop-fips, nextflow, zookeeper-fips, management-api-for-apache-cassandra-4.1, dependency-track, thingsboard, localstack, sonar-scanner-cli, knative-kafka-broker-fips,...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, apache-nifi, kayenta-fips, kserve-modelmesh, cassandra-fips, keycloak-config-cli, ontop-fips, nextflow, zookeeper-fips, management-api-for-apache-cassandra-4.1, dependency-track, thingsboard, localstack, sonar-scanner-cli, knative-kafka-broker-fips,...

CVE-2025-34282

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

CVE-2025-34281

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...

GHSA-7FCH-4F2F-JCGM vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-41254 vulnerabilities

Vulnerabilities for packages: thingsboard...

GHSA-7FCH-4F2F-JCGM vulnerabilities

Vulnerabilities for packages: thingsboard...

CVE-2025-41254 vulnerabilities

Vulnerabilities for packages: thingsboard...

EUVD-2025-34907

ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...

EUVD-2025-34906

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...

GHSA-FPQ4-R87V-G246 ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature

ThingsBoard versions 4.2.1 contain a stored cross-site scripting XSS vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload an SVG file containing malicious JavaScript, which may be executed when the file is rendered in the UI. This issue results from insufficient...

CVE-2025-34281

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Gallery", leading to a Stored Cross-Site Scripting XSS vulnerability. The exploit can be triggered when any user accesses the public API endpoint of the malicious SVG images, or if t...