chatwoot

Products

Exploited and recent CVEs

• CVE-2026-115725 Medium 4.2 Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id 0.2%
• CVE-2026-113355 Medium 4.8 Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links 0.2%
• CVE-2026-72719 Medium 6.7 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter 0.6%
• CVE-2026-63765 High 8.2 Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation 0.7%
• CVE-2026-44707 Medium 6.8 Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts 0.3%
• CVE-2026-44706 High 8.5 Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values 0.2%
• CVE-2024-0640 Medium 5.6 Stored XSS in chatwoot/chatwoot 0.3%
• CVE-2025-21628 Critical 9.1 Chatwoot has a Blind SQL-injection in Conversation and Contacts filters 0.7%
• CVE-2021-3740 Medium 6.8 Session Fixation in chatwoot/chatwoot 0.2%
• CVE-2021-3742 High 7.9 Server-Side Request Forgery (SSRF) in chatwoot/chatwoot 0.4%
• CVE-2021-3741 High 7.8 Stored Cross-site Scripting (XSS) in chatwoot/chatwoot 0.3%
• CVE-2023-2109 Medium 5.3 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot 0.4%
• CVE-2022-3741 Critical 9.4 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot 1.2%
• CVE-2022-2901 High 7.6 Improper Authorization in chatwoot/chatwoot 0.6%
• CVE-2022-0542 High 8.8 Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot 1.0%
• CVE-2022-1021 High 7.6 Insecure Storage of Sensitive Information in chatwoot/chatwoot 0.8%
• CVE-2022-1022 High 8.1 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot 4.5%
• CVE-2021-3813 Medium 6.5 Improper Privilege Management in chatwoot/chatwoot 1.1%
• CVE-2022-0527 Medium 6.1 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot 0.9%
• CVE-2022-0526 High 7.3 Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot 0.9%
• CVE-2021-3649 High 7.5 Inefficient Regular Expression Complexity in chatwoot/chatwoot 1.2%