Sploitus

16 exploited vulnerabilities in Thingsboard

Vulnerabilities with publicly known exploits

Vendors
Unknown, Thingsboard
With known exploits
16
Affected Thingsboard versions
< 4.2.1, 3.3.1

Vulnerabilities with exploits

Highest CVSS first — 3 of these already have exploit code on Sploitus

CVE-2026-36537
CVSS 9.8 CRITICAL 2026-06-15
CVE-2022-40004
CVSS 9.6 CRITICAL 2022-12-15
CVE-2025-34282 2 exploits
CVSS 9.1 CRITICAL 2025-10-17FIX AVAILABLE
📄 ThingsBoard IoT Platform 4.2.0 Server-Side Request ForgeryThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)
CVE-2022-48341
CVSS 8.8 HIGH 2023-02-23
CVE-2022-45608
CVSS 8.8 HIGH 2023-03-01
CVE-2020-27687
CVSS 8.8 HIGH 2020-12-18FIX AVAILABLE
CVE-2026-53676
CVSS 8.6 HIGH 2026-06-17
CVE-2023-26462
CVSS 8.1 HIGH 2023-02-23FIX AVAILABLE
CVE-2024-55466
CVSS 6.5 MEDIUM 2025-05-12FIX AVAILABLE
CVE-2024-3270
CVSS 6.5 MEDIUM 2024-04-03FIX AVAILABLE
CVE-2025-34281
CVSS 6.2 MEDIUM 2025-10-17FIX AVAILABLE
CVE-2024-9358
CVSS 6.0 MEDIUM 2024-09-30FIX AVAILABLE
CVE-2026-9568
CVSS 5.1 MEDIUM 2026-05-26
CVE-2021-42751 3 exploits
CVSS 4.8 MEDIUM 2022-08-12FIX AVAILABLE
ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)ThingsBoard 3.3.1 - Stored Cross-Site Scripting Vulnerability
CVE-2021-42750 3 exploits
CVSS 4.8 MEDIUM 2022-08-12FIX AVAILABLE
ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)ThingsBoard 3.3.1 - Stored Cross-Site Scripting Vulnerability
CVE-2025-9094
CVSS 4.3 MEDIUM 2025-08-17FIX AVAILABLE