{"metadata": {"vulnerability": "CVE-2021-42750", "count": 24, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 17}}, "data": [{"timestamp": "2021-10-20T00:00:00Z", "date_only": false, "value": "2021-10-20T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-42750", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-08-08T00:00:00Z", "date_only": false, "value": "2022-08-08T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_release_date.data.3.date"}, {"timestamp": "2022-08-08T16:43:08Z", "date_only": false, "value": "2022-08-08T16:43:08", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_release_date.data.1.date"}, {"timestamp": "2022-08-12T16:52:36Z", "date_only": false, "value": "2022-08-12T16:52:36.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-42750", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-08-12T16:52:36Z", "date_only": false, "value": "2022-08-12T16:52:36.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2021-42750", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-08-12T17:15:00Z", "date_only": false, "value": "2022-08-12T17:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2FVG-6M83-PJW6", "record": "GHSA-2FVG-6M83-PJW6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-08-12T17:15:00Z", "date_only": false, "value": "2022-08-12T17:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-42750", "record": "GSD-2021-42750", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-08-12T17:15:08.460Z", "date_only": false, "value": "2022-08-12T17:15:08.460000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_release_date.data.2.date"}, {"timestamp": "2022-08-12T17:15:08.460Z", "date_only": false, "value": "2022-08-12T17:15:08.460", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-42750", "record": "FKIE_CVE-2021-42750", "field": "published"}, {"timestamp": "2022-08-12T20:33:29Z", "date_only": false, "value": "2022-08-12T20:33:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/48095", "record": "CVE-2021-42750", "field": "creation_timestamp", "uuid": "b77435da-c121-48db-8f2a-5a073b7c36eb", "content": "\u203c CVE-2021-42750 \u203c\n\nA cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/48095"}, {"timestamp": "2022-08-13T00:00:24Z", "date_only": false, "value": "2022-08-13T00:00:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2FVG-6M83-PJW6", "record": "GHSA-2FVG-6M83-PJW6", "field": "published"}, {"timestamp": "2022-08-15T19:04:00Z", "date_only": false, "value": "2022-08-15T19:04Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-42750", "record": "GSD-2021-42750", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-08-15T19:04:19.043Z", "date_only": false, "value": "2022-08-15T19:04:19.043000", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_update_date.data.1.date"}, {"timestamp": "2022-08-16T00:00:00Z", "date_only": false, "value": "2022-08-16T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_update_date.data.2.date"}, {"timestamp": "2022-08-16T00:00:24Z", "date_only": false, "value": "2022-08-16T00:00:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2FVG-6M83-PJW6", "record": "GHSA-2FVG-6M83-PJW6", "field": "modified"}, {"timestamp": "2023-09-20T00:00:00Z", "date_only": false, "value": "2023-09-20T00:00:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_release_date.data.0.date"}, {"timestamp": "2023-09-20T08:33:00Z", "date_only": false, "value": "2023-09-20T08:33:00", "kind": "other", "label": "Date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "sources_update_date.data.0.date"}, {"timestamp": "2023-12-13T01:23:06.244Z", "date_only": false, "value": "2023-12-13T01:23:06.244563Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-42750", "record": "GSD-2021-42750", "field": "gsd.osvSchema.modified"}, {"timestamp": "2023-12-18T12:15:24.149Z", "date_only": false, "value": "2023-12-18T12:15:24.149000Z", "kind": "other", "label": "Last update date", "source": "variot \u00b7 VAR-202208-0486", "record": "VAR-202208-0486", "field": "last_update_date"}, {"timestamp": "2024-08-04T03:38:50.149Z", "date_only": false, "value": "2024-08-04T03:38:50.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-42750", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-04T03:38:50.149Z", "date_only": false, "value": "2024-08-04T03:38:50.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-42750", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T04:10:04.017Z", "date_only": false, "value": "2026-06-17T04:10:04.017", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-42750", "record": "FKIE_CVE-2021-42750", "field": "lastModified"}, {"timestamp": "2026-09-01T20:01:26.559Z", "date_only": false, "value": "2026-09-01T20:01:26.559452Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/64717", "record": "CVE-2021-42750", "field": "creation_timestamp", "uuid": "6d65188f-4126-4ecc-997b-d1d11bba55af", "content": "Exploit Collector\nThingsboard 3.3.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png \nThingsboard version 3.3.1 suffers from multiple persistent cross site scripting vulnerabilities.\n\nSHA-256 | ebc19fabae10baaf27a649ed72c78fdc00a6360b84c4b01f5754b78406a8b3c2\n\nDownload\n# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the description of a rule node\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# Tested on: [relevant os]\n# CVE : CVE-2021-42751\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the description e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed# Exploit Title:  ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the name of a rule node\n----------\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# CVE : CVE-2021-42750\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the name e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed\n\nSource:packetstormsecurity.com", "url": "https://t.me/hacking_Attack/64717"}, {"timestamp": "2026-09-05T12:00:05.716Z", "date_only": false, "value": "2026-09-05T12:00:05.716183Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/64717", "record": "CVE-2021-42750", "field": "creation_timestamp", "uuid": "57223dbe-6f52-498d-ac39-8b0e6e9d1574", "content": "Exploit Collector\nThingsboard 3.3.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png \nThingsboard version 3.3.1 suffers from multiple persistent cross site scripting vulnerabilities.\n\nSHA-256 | ebc19fabae10baaf27a649ed72c78fdc00a6360b84c4b01f5754b78406a8b3c2\n\nDownload\n# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the description of a rule node\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# Tested on: [relevant os]\n# CVE : CVE-2021-42751\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the description e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed# Exploit Title:  ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the name of a rule node\n----------\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# CVE : CVE-2021-42750\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the name e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed\n\nSource:packetstormsecurity.com", "url": "https://t.me/hacking_Attack/64717"}]}