Thinglinks
Monthly
Unauthenticated SQL injection in ThingLinks (mqttsnet) versions prior to 1.4.0 lets remote attackers tamper with TDengine time-series data through the TDS module's /anyUser/tds/insertTableData endpoint, inserting unintended rows or overwriting existing readings. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H, 9.1) reflects an unauthenticated, no-interaction attack whose impact is data integrity and availability rather than disclosure of other data. No public exploit code or CISA KEV entry was identified at the time of analysis, but vuln.today's priority decision is act_now, so exposure of the TDS insert surface should be treated as urgent for affected deployments; the primary caveat is scope, since exploitation requires the thinglinks-tds module to be deployed with a TDengine backend and reachable over the network.
Authenticated remote code execution in ThingLinks below 1.4.0 lets any low-privilege account submit attacker-controlled Groovy script content to the /groovyScriptTest/registerScript endpoint, which is compiled and instantiated without a sandbox and therefore executes server-side with the application's privileges. The flaw sits in the rule engine's Groovy script test/register flow and is fixed in 1.4.0; no public exploit code was identified at time of analysis, but the only prerequisites are a valid authenticated session and network reachability to the endpoint, so risk is highest where the management interface is exposed to untrusted or lower-trust users. This is a genuine high-priority issue rather than a high-score-but-low-risk artifact, and the vendor advisory plus upstream commit and 1.4.0 release tag are all publicly available.
Unauthenticated SQL injection in ThingLinks (mqttsnet) versions prior to 1.4.0 lets remote attackers tamper with TDengine time-series data through the TDS module's /anyUser/tds/insertTableData endpoint, inserting unintended rows or overwriting existing readings. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:H/A:H, 9.1) reflects an unauthenticated, no-interaction attack whose impact is data integrity and availability rather than disclosure of other data. No public exploit code or CISA KEV entry was identified at the time of analysis, but vuln.today's priority decision is act_now, so exposure of the TDS insert surface should be treated as urgent for affected deployments; the primary caveat is scope, since exploitation requires the thinglinks-tds module to be deployed with a TDengine backend and reachable over the network.
Authenticated remote code execution in ThingLinks below 1.4.0 lets any low-privilege account submit attacker-controlled Groovy script content to the /groovyScriptTest/registerScript endpoint, which is compiled and instantiated without a sandbox and therefore executes server-side with the application's privileges. The flaw sits in the rule engine's Groovy script test/register flow and is fixed in 1.4.0; no public exploit code was identified at time of analysis, but the only prerequisites are a valid authenticated session and network reachability to the endpoint, so risk is highest where the management interface is exposed to untrusted or lower-trust users. This is a genuine high-priority issue rather than a high-score-but-low-risk artifact, and the vendor advisory plus upstream commit and 1.4.0 release tag are all publicly available.