{"uuid": "6d65188f-4126-4ecc-997b-d1d11bba55af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42750", "type": "seen", "source": "https://t.me/hacking_Attack/64717", "content": "Exploit Collector\nThingsboard 3.3.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png \nThingsboard version 3.3.1 suffers from multiple persistent cross site scripting vulnerabilities.\n\nSHA-256 | ebc19fabae10baaf27a649ed72c78fdc00a6360b84c4b01f5754b78406a8b3c2\n\nDownload\n# Exploit Title: ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the description of a rule node\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# Tested on: [relevant os]\n# CVE : CVE-2021-42751\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the description e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed# Exploit Title:  ThingsBoard 3.3.1 - Stored Cross-Site Scripting (XSS) within the name of a rule node\n----------\n# Date: 03/08/2022\n# Exploit Author: Steffen Langenfeld & Sebastian Biehler\n# Vendor Homepage: https://thingsboard.io/\n# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1\n# Version: 3.3.1\n# CVE : CVE-2021-42750\n# Tested on: Linux\n\n#Proof-Of-Concept:\nWhen creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.\n\n#Steps\n\n1. Create a new rule node (via the menu \"Rule chains\")\n2. Put a javascript payload within the name e.g \n3. Save the node\n4. Upon hovering above the node within the editor the payload is executed\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:26.559452Z"}