Advisories · Technology
chatwoot.
Every CVE that names chatwoot among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.3 Low
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
- chatwoot
- Broken access control
- CVSS 4.8 Medium
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
- chatwoot
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
- chatwoot
- Server-side request forgery (SSRF)
- CVSS 6.7 Medium
Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter
- chatwoot
- Broken access control
- CVSS 8.8 High
Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation
- chatwoot
- Authentication bypass
- CVSS 6.8 Medium
Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts
- chatwoot
- Authentication bypass
- CWE-283
- CVSS 8.5 High
Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values
- chatwoot
- SQL injection
- CVSS 5.3 Medium
chatwoot Webhook API trigger.rb Trigger server-side request forgery
- chatwoot
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
chatwoot Signup Endpoint login improper authorization
- chatwoot
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
chatwoot Admin IframeLoader.vue cross site scripting
- chatwoot
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.9 Medium
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
- chatwoot
- CWE-345
- CWE-346
- CVSS 9.1 CriticalCritical · CVSS 9+
Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
- chatwoot
- SQL injection