chatwoot

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

chatwoot records in CISA KEV

No chatwoot vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Chatwoot 17 records HIGH

Records

17 records in Chatwoot · all components

TI-2022-03436 CVE-2022-3741 · GHSA-wjg3-46v4-3f44

Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

HIGH 75

Impact varies for each individual vulnerability in the application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01231 Published 2022-10-28 Fixed in v2.10.0 CWE-307

TI-2023-01984 CVE-2023-2109 · GHSA-9497-rgpm-w253

Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot

MEDIUM 60

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.14.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00366 Published 2023-04-17 Fixed in 2.14.0 CWE-79

TI-2025-11229 CVE-2025-12246 · GHSA-8pv5-qj88-7mx6

chatwoot Admin IframeLoader.vue cross site scripting

MEDIUM 57

A security flaw has been discovered in chatwoot up to 4.7.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00407 Published 2025-10-27 No fix listed CWE-79

TI-2024-00591 CVE-2024-0640 · GHSA-8gfh-hxjj-c33j

Stored XSS in chatwoot/chatwoot

MEDIUM 57

A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00269 Published 2025-03-20 Fixed in 3.5.2 CWE-79

TI-2025-15587 CVE-2025-21628

Chatwoot has a Blind SQL-injection in Conversation and Contacts filters

MEDIUM 40

Chatwoot is a customer engagement suite.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00692 Published 2025-01-09 Fixed in 3.16.0 CWE-89

TI-2021-02675 CVE-2021-3742 · GHSA-gvwh-c4r7-8fm9

Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

MEDIUM 40

A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00397 Published 2024-11-15 Fixed in 2.5.0 CWE-918

TI-2021-02593 CVE-2021-3649 · GHSA-964r-mpxx-74p7

Inefficient Regular Expression Complexity in chatwoot/chatwoot

LOW 35

chatwoot is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01222 Published 2021-07-16 No fix listed CWE-1333

TI-2025-11228 CVE-2025-12245 · GHSA-hgg8-54gw-8v33

chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation

LOW 32

A vulnerability was identified in chatwoot up to 4.7.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2025-10-27 No fix listed CWE-345

TI-2022-02690 CVE-2022-2901 · GHSA-2g92-fxg4-7jq9

Improper Authorization in chatwoot/chatwoot

LOW 32

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00639 Published 2022-09-06 Fixed in 2.8 CWE-285

TI-2022-00920 CVE-2022-1022 · GHSA-67m8-r6w4-jw3p

Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

LOW 32

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.04499 Published 2022-04-21 Fixed in 2.5.0 CWE-79

TI-2021-02744 CVE-2021-3813 · GHSA-hcf5-6f3p-x53j

Improper Privilege Management in chatwoot/chatwoot

LOW 31

Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01086 Published 2022-02-09 Fixed in v2.2 CWE-269

TI-2021-02673 CVE-2021-3740 · GHSA-7c75-4mxr-f248

Session Fixation in chatwoot/chatwoot

LOW 31

A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0.

CVSS 3.1MEDIUM 6.8 Adjacent network Low privileges User interaction EPSS 0.00209 Published 2024-11-15 Fixed in 2.4.0 CWE-384

TI-2022-00462 CVE-2022-0542 · GHSA-2h4c-86hw-hmr7

Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot

LOW 29

Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00998 Published 2022-08-19 Fixed in 2.7.0 CWE-79

TI-2022-00447 CVE-2022-0527 · GHSA-v88g-7jhf-f5wv

Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

LOW 29

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0085 Published 2022-02-09 Fixed in 2.2.0 CWE-79

TI-2022-00446 CVE-2022-0526 · GHSA-qf4q-469q-crcp

Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

LOW 29

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00856 Published 2022-02-09 Fixed in 2.2.0 CWE-79

TI-2022-00919 CVE-2022-1021 · GHSA-5jgf-vj7m-2fjg

Insecure Storage of Sensitive Information in chatwoot/chatwoot

LOW 26

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00778 Published 2022-08-19 Fixed in 2.6.0 CWE-922

TI-2021-02674 CVE-2021-3741 · GHSA-jwrg-4wf2-p7jw

Stored Cross-site Scripting (XSS) in chatwoot/chatwoot

LOW 24

A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00301 Published 2024-11-15 Fixed in 2.6 CWE-79

Open these records in search →