chatwoot records
17 published records for vendor chatwoot.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 5.9%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8
- CWE-269 Improper Privilege Management1
- CWE-285 Improper Authorization1
- CWE-307 Improper Restriction of Excessive Authentication Attempts1
- CWE-345 Insufficient Verification of Data Authenticity1
- CWE-384 Session Fixation1
The weakness classes this vendor ships most often: where to look.
CWEAll records
17 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2022-3741No exploit | Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwootchatwoot · chatwoot · CWE-307 | Critical9.8 | — | 1.2% | Oct 28, 2022 |
35Monitor | CVE-2025-21628No exploit | Chatwoot has a Blind SQL-injection in Conversation and Contacts filterschatwoot · chatwoot · CWE-89 | High8.8 | — | 0.6% | Jan 9, 2025 |
35Monitor | CVE-2021-3742No exploit | Server-Side Request Forgery (SSRF) in chatwoot/chatwootchatwoot · chatwoot · CWE-918 | High8.8 | — | 0.3% | Nov 15, 2024 |
30Monitor | CVE-2021-3649No exploit | Inefficient Regular Expression Complexity in chatwoot/chatwootchatwoot · chatwoot · CWE-1333 | High7.5 | — | 1.2% | Jul 16, 2021 |
28Monitor | CVE-2022-2901No exploit | Improper Authorization in chatwoot/chatwootchatwoot · chatwoot · CWE-285 | High7.1 | — | 0.6% | Sep 6, 2022 |
27Monitor | CVE-2021-3740No exploit | Session Fixation in chatwoot/chatwootchatwoot · chatwoot · CWE-384 | Medium6.8 | — | 0.2% | Nov 15, 2024 |
26Monitor | CVE-2021-3813No exploit | Improper Privilege Management in chatwoot/chatwootchatwoot · chatwoot · CWE-269 | Medium6.5 | — | 1.0% | Feb 9, 2022 |
24Monitor | CVE-2022-0542No exploit | Cross-site Scripting (XSS) - DOM in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium6.1 | — | 0.9% | Aug 19, 2022 |
24Monitor | CVE-2022-0526No exploit | Cross-site Scripting (XSS) - Stored in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium6.1 | — | 0.8% | Feb 9, 2022 |
24Monitor | CVE-2022-0527No exploit | Cross-site Scripting (XSS) - Stored in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium6.1 | — | 0.8% | Feb 9, 2022 |
24Monitor | CVE-2023-2109No exploit | Cross-site Scripting (XSS) - DOM in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium6.1 | — | 0.3% | Apr 16, 2023 |
22Monitor | CVE-2022-1022No exploit | Cross-site Scripting (XSS) - Stored in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium5.4 | — | 4.4% | Apr 21, 2022 |
22Monitor | CVE-2025-12245No exploit | chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validationchatwoot · chatwoot · CWE-345 | Medium5.5 | — | 0.3% | Oct 27, 2025 |
21Monitor | CVE-2022-1021No exploit | Insecure Storage of Sensitive Information in chatwoot/chatwootchatwoot · chatwoot · CWE-922 | Medium5.4 | — | 0.7% | Aug 19, 2022 |
21Monitor | CVE-2021-3741No exploit | Stored Cross-site Scripting (XSS) in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium5.4 | — | 0.3% | Nov 15, 2024 |
19Monitor | CVE-2024-0640No exploit | Stored XSS in chatwoot/chatwootchatwoot · chatwoot · CWE-79 | Medium4.8 | — | 0.2% | Mar 20, 2025 |
8Monitor | CVE-2025-12246No exploit | chatwoot Admin IframeLoader.vue cross site scriptingchatwoot · chatwoot · CWE-79 | Low2.1 | — | 0.4% | Oct 27, 2025 |
- CVE-2022-374139Monitor
Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot
CriticalCVSS 9.8No exploitEPSS 1%chatwoot · chatwootOct 28, 2022
- CVE-2025-2162835Monitor
Chatwoot has a Blind SQL-injection in Conversation and Contacts filters
HighCVSS 8.8No exploitEPSS 0%chatwoot · chatwootJan 9, 2025
- CVE-2021-374235Monitor
Server-Side Request Forgery (SSRF) in chatwoot/chatwoot
HighCVSS 8.8No exploitEPSS 0%chatwoot · chatwootNov 15, 2024
- CVE-2021-364930Monitor
Inefficient Regular Expression Complexity in chatwoot/chatwoot
HighCVSS 7.5No exploitEPSS 1%chatwoot · chatwootJul 16, 2021
- CVE-2022-290128Monitor
Improper Authorization in chatwoot/chatwoot
HighCVSS 7.1No exploitEPSS 0%chatwoot · chatwootSep 6, 2022
- CVE-2021-374027Monitor
Session Fixation in chatwoot/chatwoot
MediumCVSS 6.8No exploitEPSS 0%chatwoot · chatwootNov 15, 2024
- CVE-2021-381326Monitor
Improper Privilege Management in chatwoot/chatwoot
MediumCVSS 6.5No exploitEPSS 1%chatwoot · chatwootFeb 9, 2022
- CVE-2022-054224Monitor
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
MediumCVSS 6.1No exploitEPSS 0%chatwoot · chatwootAug 19, 2022
- CVE-2022-052624Monitor
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
MediumCVSS 6.1No exploitEPSS 0%chatwoot · chatwootFeb 9, 2022
- CVE-2022-052724Monitor
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
MediumCVSS 6.1No exploitEPSS 0%chatwoot · chatwootFeb 9, 2022
- CVE-2023-210924Monitor
Cross-site Scripting (XSS) - DOM in chatwoot/chatwoot
MediumCVSS 6.1No exploitEPSS 0%chatwoot · chatwootApr 16, 2023
- CVE-2022-102222Monitor
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
MediumCVSS 5.4No exploitEPSS 4%chatwoot · chatwootApr 21, 2022
- CVE-2025-1224522Monitor
chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation
MediumCVSS 5.5No exploitEPSS 0%chatwoot · chatwootOct 27, 2025
- CVE-2022-102121Monitor
Insecure Storage of Sensitive Information in chatwoot/chatwoot
MediumCVSS 5.4No exploitEPSS 0%chatwoot · chatwootAug 19, 2022
- CVE-2021-374121Monitor
Stored Cross-site Scripting (XSS) in chatwoot/chatwoot
MediumCVSS 5.4No exploitEPSS 0%chatwoot · chatwootNov 15, 2024
- CVE-2024-064019Monitor
Stored XSS in chatwoot/chatwoot
MediumCVSS 4.8No exploitEPSS 0%chatwoot · chatwootMar 20, 2025
- CVE-2025-122468Monitor
chatwoot Admin IframeLoader.vue cross site scripting
LowCVSS 2.1No exploitEPSS 0%chatwoot · chatwootOct 27, 2025